Where consent is the basis, the controller must be able to prove it was given; a consent request inside a wider written declaration must stand out clearly in plain, accessible language; whether a contract or service was made conditional on consent to unnecessary processing is weighed in judging whether consent was free; and the data subject must be told before consenting that it can be withdrawn at any time. Consent itself means a freely given, specific, informed and unambiguous written declaration or affirmative action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.