Where consent is relied on for a child (under 18) or a person lacking capacity, the controller must obtain a parent's or guardian's consent and apply verification mechanisms, including government approved identification, to verify age and consent (not needed for vital interests or confidential medical or social care). The controller bears the burden of proving consent, and consent is not freely given where a contract is made conditional on processing not necessary for it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.