The data controller bears the burden of proving a data subject's consent. Whether consent was freely and intentionally given takes into account whether performance of a contract or provision of a service is made conditional on consent to processing not necessary for that contract; silence or inactivity is not consent; the data subject is informed of the right to withdraw before consent is given, and withdrawal does not affect the lawfulness of prior processing; the request is in clear and simple language and an accessible format; consent is affirmative, never a pre-selected confirmation, and may be given in writing, orally or electronically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.