Consent method uses an FTC-approved mechanism

COPPA §312.5 requires 'verifiable' parental consent — a method that gives reasonable assurance the person consenting is actually the parent, not the child. The FTC's approved methods (email-plus, credit card transaction, signed form, KBA, government ID) each create an out-of-band verification step the child cannot complete. A checkbox on the child's own registration form gives zero assurance that any parent was involved. If a consent mechanism cannot reliably exclude the child from self-approving, it fails the 'verifiable' standard and the operator is treated as collecting data without consent.

Use the email-plus method for applications handling data internally: send a direct notice to a parent-provided email address and require an explicit click on a confirmation link before any account data is stored. Document the method in your privacy policy.

async function sendParentConsentEmail(
  { parentEmail, childEmail, token }:
  { parentEmail: string; childEmail: string; token: string }
) {
  await emailService.send({
    to: parentEmail,
    subject: 'Action required: Your child wants to create an account',
    html: `
      <p>Your child (${childEmail}) has requested an account.</p>
      <h2>What we collect from children</h2>
      <p>Display name and usage data only. No location, phone, or real name.
         Not shared with third parties for advertising.</p>
      <h2>To approve</h2>
      <p><a href="https://example.com/parent-consent/${token}">Click here to approve</a></p>
      <p>Link expires in 7 days. Ignore this email to decline — no account will be created.</p>
    `,
  })
}

If your application shares children's data with third parties, the email-plus method is insufficient — consult a COPPA attorney about credit card verification or KBA methods.