Only data reasonably necessary for the child's activity is collected

COPPA §312.7 prohibits operators from conditioning child participation on disclosing more personal information than is reasonably necessary for the activity. Requiring a child to provide their full name, school affiliation, and grade level to use a feature that only needs a display name is an independent COPPA violation — separate from the consent and age-gate requirements. Over-collection also expands the blast radius of a data breach: every field collected from a child that wasn't necessary is a field that could be exposed and that regulators will cite. GDPR Article 5(1)(c) ('data minimisation') applies the same principle to EU child data.

Audit the child account schema and remove every field not actively used by a product feature. Apply the same audit to analytics event schemas for child sessions.

// BEFORE — child signup collects unnecessary data
type ChildSignupData = {
  displayName: string   // used
  fullName: string      // unused — remove
  email: string         // used
  dateOfBirth: string   // used
  school: string        // unused — remove
  grade: string         // unused — remove
  city: string          // unused — remove
}

// AFTER — minimal collection for child accounts
type ChildSignupData = {
  displayName: string   // shown in UI
  email: string         // parent consent notification
  dateOfBirth: string   // age verification
}

For analytics, replace individual behavioral event streams for child sessions with aggregate counts. If you need product metrics from child users, prefer server-side counters that don't persist a per-user event log.