Verifiable parental consent obtained before collecting PI from children under 13

COPPA §312.5 and §312.4 prohibit collecting any personal information from a child under 13 until verifiable parental consent is obtained. 'Verifiable' is the operative word: a checkbox on the child's own signup form is not consent from the parent — it is consent from the child, which COPPA explicitly does not recognize. Creating a user record and storing the child's email and date of birth before the parent has confirmed is a COPPA §312.5 violation from the moment the INSERT executes. The FTC has levied eight-figure fines (FTC v. Google/YouTube, 2019: $170M) specifically for collecting children's data before consent.

Implement a two-stage flow: Stage 1 stores only a short-lived pending-consent record (not a user account) and emails the parent. Stage 2, triggered by the parent's confirmation link, creates the actual user account.

// Stage 1: app/api/auth/child-signup/route.ts
// Store NOTHING in the users table yet
export async function POST(req: Request) {
  const { childEmail, dateOfBirth, parentEmail } = await req.json()
  if (computeAge(new Date(dateOfBirth)) >= 13) {
    return Response.json({ error: 'Use the standard signup flow.' }, { status: 400 })
  }
  const token = crypto.randomUUID()
  await db.pendingConsentRequest.create({
    data: { token, childEmail, parentEmail, dateOfBirth,
            expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) }
  })
  await sendParentConsentEmail({ parentEmail, childEmail, token })
  return Response.json({ status: 'awaiting_parental_consent' })
}

The child's account and any personal data are created only after the parent's confirmation link is clicked and a parental_consents record is written.