The specification's privacy guidance covers a spectrum of privacy from fully identifying to anonymous; software trust boundaries; personally identifiable information; correlation through identifiers, signatures, metadata and device fingerprinting; favouring abstract claims and data minimisation; bearer credentials; correlation during validation; storage providers and data mining; aggregation; patterns of use; legal processes; sharing with the wrong party; data theft; issuance frequency; preferring single-use credentials; private browsing; and the privacy impact of issuer cooperation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.