Settings must be high privacy by default unless a compelling reason in the child's best interests justifies otherwise: children's data is not visible to other users unless they change settings, optional and personalising uses and third-party uses must be activated by the child, and only core-service processing needs no setting (interpreted narrowly). Consider extra interventions when a setting is changed, let changes be permanent or session-only without nudging to lower privacy, keep user choices or high privacy defaults across software updates, and support separate profiles on shared devices; privacy settings alone do not satisfy consent or the Article 8 parental consent rule.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.