The Act does not restrict compliance with law and investigations, cooperation with law enforcement, legal claims, providing requested products or contracts, protecting life or safety, security and fraud prevention, approved public-interest research, internal research, recalls, repair of errors, or internal operations consistent with consumer expectations; evidentiary privilege and free speech are preserved, and a discloser is not liable for a recipient's unknown violations. Data processed under these exemptions must be necessary, proportionate and limited, protected by reasonable security, and the controller bears the burden of showing the exemption applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.