Where a controller has actual knowledge, and wilfully disregards, that a consumer is at least 13 and under 18, it must not process the consumer's data for targeted advertising and must not sell it (subject to the Age-Appropriate Design Code duty in subdivision (9)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.