The code applies to relevant information society services (apps, programs, websites, games, community environments, search, social media, messaging, streaming, marketplaces and connected toys or devices, including free ad-funded and not-for-profit services of an economic kind) that process personal data and are likely to be accessed by under-18s in the UK, not only services aimed at children; 'likely' means more probable than not, judged by the service's nature, content, appeal and access measures, and applies where children are a substantive user group. Excluded are non-commercial public services, law enforcement processing, information-only sites for real-world businesses, traditional telephony, general broadcast and preventive or counselling services. A provider deciding the code does not apply must document and support that decision, and reassess if evidence shows significant child use; services established outside the UK are caught when they offer services to, or monitor, UK users.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.