Registration structure, thinking only:
Child fills nickname and age, nothing else. Parent contact required, phone number not email. Parent and child contact info can't match, same phone/email/device on both blocks it. No instant activation, account stays pending until parent confirms.
Confirmation sent to parent's phone. Second notice sent a day later to the same number. Card verification ($0 auth, no charge) can serve as the confirming step, since a kid without card access can't complete it.
Never store the card number, processor holds that. Cardholder name and billing zip can be checked against the parent's stated name. No DIY background checks, name only matching is weak and running one properly means FCRA rules apply.
No open adult signup path. Adults only enter as staff or mod, personally known to us. New accounts only through invite from an already approved parent, no cold open registration. Manual review before any account goes live.
Parent dashboard for account status, revoking access, playtime limits. Report path routed to us directly. Kick or ban tied to the registration record.
Collecting anything tied to a child falls under COPPA.
Registration structure, thinking only:
Child fills nickname and age, nothing else. Parent contact required, phone number not email. Parent and child contact info can't match, same phone/email/device on both blocks it. No instant activation, account stays pending until parent confirms.
Confirmation sent to parent's phone. Second notice sent a day later to the same number. Card verification ($0 auth, no charge) can serve as the confirming step, since a kid without card access can't complete it.
Never store the card number, processor holds that. Cardholder name and billing zip can be checked against the parent's stated name. No DIY background checks, name only matching is weak and running one properly means FCRA rules apply.
No open adult signup path. Adults only enter as staff or mod, personally known to us. New accounts only through invite from an already approved parent, no cold open registration. Manual review before any account goes live.
Parent dashboard for account status, revoking access, playtime limits. Report path routed to us directly. Kick or ban tied to the registration record.
Collecting anything tied to a child falls under COPPA.