Providers of connected toys and devices must build in effective tools to conform to the code: be clear who processes the data and their responsibilities (outsourcing the connected element does not remove obligations), secure devices against unauthorised access, anticipate multiple users of different ages with a child-suitable default and user profiles, give clear information at point of sale and set-up (including online before purchase), find ways to deliver just-in-time information, avoid passive collection with indicators for recording and listening modes, collect no data in listening mode, and provide a way to switch connectivity off.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.