Children's data retained only as long as necessary; then deleted

COPPA §312.10 and §312.5 require operators to retain children's personal information 'only as long as reasonably necessary to fulfill the purpose for which it was collected,' then to delete it securely. Indefinite retention of child data is independently actionable — the FTC has cited absence of a documented retention schedule in enforcement actions even when consent and age-gate practices were otherwise adequate. GDPR Article 5(1)(e) imposes a parallel 'storage limitation' principle. When parental consent is revoked, all data collected under that consent must be deleted — an orphaned analytics event or usage log tied to a deleted child account is a retention violation.

Implement a cron route that deletes inactive child accounts and all associated records on a defined schedule, and ensure consent revocation triggers a cascade delete across every table that holds child data.

// app/api/cron/child-data-retention/route.ts
export async function GET() {
  const cutoff = new Date()
  cutoff.setMonth(cutoff.getMonth() - 12)  // 12-month inactivity threshold

  const inactive = await db.user.findMany({
    where: { accountType: 'child', lastActiveAt: { lt: cutoff } },
    select: { id: true }
  })

  for (const child of inactive) {
    await db.$transaction([
      db.analyticsEvent.deleteMany({ where: { userId: child.id } }),
      db.usageLog.deleteMany({ where: { userId: child.id } }),
      db.parentalConsent.deleteMany({ where: { childUserId: child.id } }),
      db.user.delete({ where: { id: child.id } }),
    ])
  }

  return Response.json({ purged: inactive.length })
}

In your privacy policy state the retention period explicitly: 'Inactive child accounts are deleted after [N] months. When parental consent is revoked, the child's account and all associated data are permanently deleted within [N] business days.'