Controllers must prepare and publish a privacy policy on every medium of collection within three months of commencing business, keep it on their site and message data subjects about developments needing new or different consent. Publicity may be by website, digital media, conspicuous posting at business premises, reading or giving a copy to the data subject, or any public media; where the policy is not given or read, the consent request must point to where it can be accessed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.