Geolocation not collected from children without parental consent

COPPA §312.2 and §312.5 include precise and coarse geolocation — as well as IP-address-derived location used persistently — within the definition of 'personal information' requiring parental consent before collection from children under 13. GDPR Article 9 adds a special-category protection for location data tied to children in the EU. Calling navigator.geolocation.getCurrentPosition() during a child session, or running an IP-to-country lookup and storing the result on the child's user record, is unconsented personal information collection unless the parental consent notice disclosed geolocation collection specifically.

Gate all geolocation collection — both browser Geolocation API and IP-to-location lookups — on account type before any data is collected or stored.

// lib/location.ts
export async function requestLocation(
  user: { accountType: string }
): Promise<GeolocationPosition | null> {
  // Never collect location from child accounts
  if (user.accountType === 'child') return null

  return new Promise((resolve, reject) => {
    navigator.geolocation.getCurrentPosition(resolve, reject)
  })
}

// app/api/middleware/location.ts
export function getLocationForSession(req: Request, accountType: string) {
  if (accountType === 'child') return null
  return geoipLookup(req.headers.get('x-forwarded-for') ?? '')
}

If geolocation is essential for a feature you want to offer child users, add explicit disclosure of geolocation collection to the parental consent notice and obtain consent before the feature activates.