Social features disabled for children without parental consent

COPPA §312.2, §312.4, and §312.5 classify making a child's personal information 'publicly available' to other users as a form of disclosure that requires parental consent. A child's display name on a public leaderboard, a public profile page, or direct messages readable by other users all fall within this definition. AI-built apps frequently expose child accounts to the same social feature set as adult accounts because the permission model was never explicitly scoped by account type. The result is that child display names, avatars, and posts become searchable and visible to arbitrary users — and each such exposure is an unconsented disclosure under §312.5.

Restrict social feature endpoints to adult account types and make child profile pages private by default.

// app/api/messages/route.ts
export async function POST(req: Request) {
  const session = await getServerSession()
  const user = await db.user.findUnique({ where: { id: session?.user?.id } })

  if (user?.accountType === 'child') {
    return Response.json(
      { error: 'Messaging is not available for child accounts.' },
      { status: 403 }
    )
  }
  // ... message creation
}

// app/profile/[userId]/page.tsx
export default async function ProfilePage({ params }: { params: { userId: string } }) {
  const profile = await db.user.findUnique({ where: { id: params.userId } })

  if (profile?.accountType === 'child') {
    const session = await getServerSession()
    if (!session) return <div>This profile is private.</div>
  }

  return <ProfileView profile={profile} />
}

If you want to enable social features for child accounts, the parental consent notice must specifically disclose that the child's information will be visible to other users, and the parent must consent to that disclosure.