A controller must comply with an authenticated request (including from a known child's parent or guardian) to confirm processing and access the personal information, correct inaccuracies, delete data provided by or obtained about the consumer (for third-party-sourced data, by keeping a minimal suppression record or opting the consumer out of non-exempt processing), obtain a portable copy of data the consumer provided where processing is automated, and opt out of sale, targeted advertising, and profiling that furthers decisions with legal or similarly significant effects.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.