Consent must be prior, free, informed and unambiguous for one or more determined purposes, by statement or clear affirmative action; when given in a written declaration covering other matters it must be clearly distinguishable, intelligible, easily accessible and in plain language, and any non-compliant part is not binding. The data subject may withdraw at any time, must be told so before consenting, and withdrawal must be simple, agile, effective, free and no harder than giving consent, without affecting earlier lawful processing. The controller bears the burden of proving consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.