Since 5 February 2026, a controller providing an information society service likely to be accessed by children must, when deciding appropriate data protection by design measures, take into account the children's higher protection matters: how children can best be protected and supported when using the service, and that children merit specific protection because they may be less aware of the risks, consequences and their rights, and have different needs at different ages and stages of development; preventive and counselling services are excluded. ICO guidance on the Act is reported to say that conforming to this code satisfies the requirement. See the official text for the full requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.