A controller may not process a consumer's sensitive data without first presenting the consumer with clear notice and an opportunity to opt out of the processing. This is a critical UCPA distinction: unlike VCDPA, CPA, and CTDPA which require opt-in consent for sensitive data, UCPA only requires notice and opt-out for most sensitive data. Processing of personal data concerning a known child must be in accordance with COPPA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.