A controller must not process sensitive data concerning a consumer without first obtaining consent, and must process personal data of a known child in accordance with COPPA. Sensitive data covers data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, treatment or diagnosis, financial information (account number, log-in, financial account or card number with the code or password giving access), sex life or sexual orientation, citizenship or immigration status, status as transgender or non-binary, genetic or biometric data processed to uniquely identify a person, personal data collected from a known child, and precise geolocation data (within 1,750 feet).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.