No persistent identifiers for cross-site tracking of children

COPPA §312.2 and §312.8 define 'personal information' to include persistent identifiers that track a child over time or across websites — explicitly including cookies and device IDs. Google Analytics' _ga cookie (2-year expiry), Hotjar's _hjid cookie, and Amplitude's persistent device ID all qualify. Loading any of these on child sessions without verifiable parental consent disclosing the cross-site tracking is a COPPA violation. The ePrivacy Directive Article 5(3) adds a parallel EU obligation to obtain consent before setting non-essential cookies on any user, including children.

Gate all third-party analytics initialization on account type at the server side, not just in client components where timing issues can allow SDK initialization before the check completes.

// app/providers/analytics-provider.tsx
'use client'
import { useEffect } from 'react'
import { useUser } from '@/hooks/use-user'

export function AnalyticsProvider({ children }: { children: React.ReactNode }) {
  const { user } = useUser()

  useEffect(() => {
    // Never initialize tracking for child accounts
    if (!user || user.accountType === 'child') return
    initGoogleAnalytics()
    initHotjar()
    initAmplitude()
  }, [user])

  return <>{children}</>
}

Also disable third-party script loading at the Next.js layout level for child user contexts: a <Script> tag that renders before useUser() resolves can still fire. Set SameSite=Strict on all first-party session cookies for child accounts to prevent cross-site use.