Provide a reasonably accessible + clear + meaningful privacy notice that includes: (1) categories of personal data processed, (2) purposes of processing, (3) how consumers may exercise their rights including the appeal process, (4) categories of personal data shared with third parties, (5) categories of third parties with whom data is shared, (6) opt-out method for sale + targeted advertising + profiling. Apply data minimisation - process only personal data adequate + relevant + reasonably necessary in relation to the disclosed purposes. Apply purpose limitation - do not process personal data for purposes incompatible with the disclosed purposes without consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.