Age Gates and Children's Data: Where a Birthday Box Stops Being Consent
A date of birth field is the cheapest compliance object on the internet. It costs an afternoon to add and it produces a reassuring record: user said they were over 13, or over 16, or over 18. The record is also, on its own, close to worthless, because children can count. They know which year to pick.
Regulators know that too. Enforcement around children's data in the US under COPPA and in Europe under GDPR member state age rules keeps returning to the same point: a service that is likely to be used by children cannot outsource the whole question to a form field and call the answer knowledge.
Neutral gates, and why the word neutral matters
A well built gate asks for age without steering the answer. No default year prefilled near the adult boundary, no error message that teaches the child which answer unlocks the account, and no immediate retry that lets them walk the year back until it passes. Those design details sound small. In investigations they are the evidence, because they show whether the service wanted a true answer or a passing one.
Blocking and re-entry matter just as much. If a child who fails the gate can return in the same session with a new date and a fresh email, the gate is a turnstile that only stops the honest. A cooling off period, or carrying the failed result across the signup attempt, is what separates a check from a ritual.
Parental consent has to be verifiable
Where a service relies on a parent's consent, the consent has to come from the parent, with a method scaled to the risk. An email to an address the child supplies, confirmed by a click, is at the weak end and has drawn criticism for years because the child can supply any inbox they control. Stronger flows use payment card checks, identity documents, or signed forms for higher risk processing. The point is not maximal friction everywhere. It is that the method should match what the data will be used for: advertising profiles demand more than a newsletter signup.
Keep the consent record separate from the child's account activity. Who consented, when, by what method, and to which version of the notice: those four fields are what an inquiry will ask for, sometimes years later.
Mixed audiences are the hard case
Most services are not built for children and are not adult only. They are general audience products that children use anyway, and actual knowledge is the trigger in US law: once a service knows, from reports, from its own moderation, from the content itself, that a user is underage, the gate record stops protecting it. Teams need a route for that knowledge to reach the compliance side. A trust and safety queue full of obviously underage accounts that nobody acts on is knowledge sitting in a ticket system.
Design for the downgrade path. When an account is found to be a child's, what happens to its data, its public posts, its purchase history? Deleting everything on discovery, with a clear notice to the parent where contact is possible, is cleaner than quietly relabelling the account and keeping the history.
Features carry their own age logic
Public profiles, direct messages from strangers, location sharing, and in app purchases each shift the risk, and several app store and regulatory frameworks now expect feature level limits rather than one account level birthday. A service can admit a younger teen to a closed, parent visible account while withholding public posting and stranger contact. That granularity is more work than a single gate. It is also the direction travel is clearly heading, on both sides of the Atlantic.
Related reading
These earlier guides cover connected questions in more depth: Consent for AI Chatbots: What a Chat Notice Has to Say Before Anyone Types, Privacy Notice Version Control: Why Editing in Place Breaks Your Proof, and Global Privacy Control in Mobile Apps: The Signal Most Teams Forget.
Frequently asked questions
Is a date of birth check enough to comply with COPPA?
On its own, generally no for services directed at children or with actual knowledge of child users. COPPA expects verifiable parental consent through an approved method before collecting personal information from a child under 13, and a self declared birthday is not that method.
What age applies in Europe?
GDPR sets 16 as the default age for a child to consent to information society services, and member states may lower it to not below 13, so the applicable age depends on the child's country. Services operating across Europe have to handle that variation.
What if a child lied about their age?
A service that used a neutral, non steering gate and acted promptly when it learned the truth is in a far stronger position than one that designed the gate to be passed. What it does after discovery matters: stop the processing, delete or restrict the data, and document the steps.
Do parents have to be told what data is collected?
Yes. A parental consent flow that does not list the categories of data, the purposes, and any disclosure to third parties is not informed consent, and the notice has to be readable at the moment of the decision, not linked away in general terms.