Age verification mechanism exists before data collection from potential children

COPPA §312.5 requires operators to obtain verifiable parental consent before collecting personal information from children under 13. Without a server-enforced age gate, your registration endpoint creates accounts and stores personal data — name, email, date of birth — for users who may be children, with no parental involvement. The FTC treats this as a per-se violation regardless of whether you intended to attract children. Civil penalties reached $170 million in FTC v. Google/YouTube and $5.7 million in FTC v. Musical.ly. A client-side-only age gate provides zero legal protection because it is trivially bypassed by altering the form submission.

Add server-side age validation to every account creation and data collection endpoint before committing any data to the database. The component below collects date of birth neutrally and the API route rejects submissions from users under 13 at the server level.

// app/api/auth/signup/route.ts
export async function POST(req: Request) {
  const { email, password, dateOfBirth } = await req.json()
  const age = computeAge(new Date(dateOfBirth))
  if (age < 13) {
    // Return 403 before writing any data
    return Response.json({ error: 'Age requirement not met.' }, { status: 403 })
  }
  // ... proceed with account creation
}

Do not rely on ageVerified: true flags sent from the client — always compute age from the submitted birth date on the server.