Age gate cannot be trivially bypassed by refreshing, clearing cookies, etc.

COPPA §312.5 requires meaningful age verification — a gate that can be bypassed by opening a new incognito tab provides no protection. If age validation depends on a client-accessible cookie or localStorage value that the server trusts as proof of passing the gate, a child who gets blocked can clear browser storage and immediately re-register with a different birth date. The FTC expects age verification to be durable: the server must independently validate the submitted birth date on every account creation request and apply friction to repeated attempts.

Validate the submitted birth date server-side on every call — never read ageVerified or similar flags from the client. Add IP-based rate limiting to deter repeated retry attempts.

// app/api/auth/signup/route.ts
const attempts = new Map<string, { count: number; first: number }>()
const WINDOW_MS = 60 * 60 * 1000
const MAX = 5

export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for') ?? 'unknown'
  const now = Date.now()
  const rec = attempts.get(ip)

  if (rec && now - rec.first < WINDOW_MS && rec.count >= MAX) {
    return Response.json({ error: 'Too many attempts.' }, { status: 429 })
  }
  attempts.set(ip, { count: (rec?.count ?? 0) + 1, first: rec?.first ?? now })

  const { dateOfBirth } = await req.json()
  // Always compute age from the submitted value — ignore any client flag
  if (computeAge(new Date(dateOfBirth)) < 13) {
    return Response.json({ error: 'Age requirement not met.' }, { status: 403 })
  }
}

In production, replace the in-memory map with Redis or an equivalent distributed rate limiter.