A controller must obtain the consumer's consent (a clear affirmative, freely given, specific, informed, unambiguous act) before processing sensitive data, and for a known child's sensitive data must process it in line with the Children's Online Privacy Protection Act and its rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.