Users under 13 blocked from accounts or routed to COPPA-compliant experience

COPPA §312.5 and §312.3 require that when a child is identified as under 13, no personal information is collected or stored unless verifiable parental consent is obtained. A client-side block that the server ignores is not a block — it is a UI illusion. If the account creation API processes a submission regardless of the submitted age, the operator is collecting personal information from an identified child without consent, which is a direct COPPA §312.5 violation. The FTC does not require intent; the data being stored is sufficient to establish the violation.

Enforce the under-13 block at the API layer, not just in the form component. The route below validates age, sets a short-lived age_blocked cookie to deter immediate retry, and returns a 403 before writing any data.

// app/api/auth/signup/route.ts
import { cookies } from 'next/headers'

export async function POST(req: Request) {
  const { email, password, dateOfBirth } = await req.json()
  const ageYears = computeAge(new Date(dateOfBirth))

  if (ageYears < 13) {
    cookies().set('age_blocked', '1', {
      maxAge: 60 * 60 * 24,
      httpOnly: true,
      sameSite: 'strict',
    })
    return Response.json(
      { error: 'This service requires users to be 13 or older.' },
      { status: 403 }
    )
  }
  // ... account creation
}

If you intend to support child accounts via parental consent, implement the two-stage pending-consent flow described in the verifiable-consent check instead of hard-blocking.