Parents can review children's data and revoke consent at any time

COPPA §312.6 and §312.5 give parents explicit statutory rights to review personal information collected from their child and to revoke consent — which triggers deletion of all data collected under that consent. These are not optional customer-service courtesies; they are legal obligations enforceable by the FTC. If a parent contacts your support team and there is no defined process, no identity verification step, and no mechanism to actually produce or delete the data, you are in violation of §312.6 regardless of whether you obtained consent correctly in the first place. GDPR Article 17 extends the deletion obligation to EU child data as well.

Implement a self-serve parental review flow: the parent submits their email, receives a time-limited review link, and can revoke consent and delete the child's account through authenticated API endpoints. Document the process and SLA in your privacy policy.

// app/api/parent/revoke/[childId]/route.ts
export async function DELETE(req: Request, { params }: { params: { childId: string } }) {
  const token = req.headers.get('x-parent-review-token')
  const reviewToken = await db.parentReviewToken.findUnique({
    where: { token, expiresAt: { gt: new Date() } }
  })
  if (!reviewToken) return Response.json({ error: 'Invalid or expired token.' }, { status: 403 })

  await db.parentalConsent.updateMany({
    where: { childUserId: params.childId, parentEmail: reviewToken.parentEmail },
    data: { revokedAt: new Date() }
  })
  await db.user.delete({ where: { id: params.childId } })
  return Response.json({ status: 'revoked' })
}

In your privacy policy, add: 'Parents may review, correct, or request deletion of their child's data at any time by [process]. We respond within [N] business days and verify parent identity before releasing any information.'