A controller must not process a consumer's personal data for targeted advertising, sale or significant-effect profiling without consent where it has actual knowledge, or wilfully disregards, that the consumer is at least 13 and younger than 17 (paragraph (7) before the 2026 renumbering).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.