If users under 13 possible: explicit parental consent flow and COPPA compliance

COPPA §312.5 prohibits collecting personal information from children under 13 without verifiable parental consent — violations carry civil penalties up to $51,744 per child per violation. GDPR Art. 8 sets the age of digital consent at 16 (or 13 in member states that lower it), and requires parental authorization below that threshold. General-purpose tools, educational apps, and games are high-risk categories because children are a foreseeable audience even when not explicitly targeted. A missing age gate means every under-13 signup is a distinct legal violation, and the regulator does not need to prove harm — the unauthorized collection is the violation.

For adult-only services, add an explicit age gate at signup and document in the privacy policy that the service is not intended for users under 13 (or 16 for GDPR jurisdictions).

// In your signup form — adult-only gate
<label className="flex items-center gap-2">
  <input type="checkbox" required name="ageConfirm" />
  I confirm I am 18 years of age or older
</label>

// Server-side: validate the checkbox was submitted
if (!formData.get('ageConfirm')) {
  return { error: 'You must confirm your age to create an account.' }
}

For services that do allow minors, a checkbox is insufficient for COPPA — verifiable parental consent requires a credit card charge, digital signature, or government ID. Consult a legal advisor before building a COPPA-compliant parental consent flow. At minimum, include language in your Terms of Service and privacy policy explicitly stating the minimum age.