Except as the Act otherwise provides, a controller must not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes unless it obtains the consumer's consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.