{"id":1032,"date":"2026-05-09T13:00:00","date_gmt":"2026-05-09T18:00:00","guid":{"rendered":"https:\/\/tolinku.com\/blog\/?p=1032"},"modified":"2026-03-07T04:46:07","modified_gmt":"2026-03-07T09:46:07","slug":"onboarding-compliance","status":"publish","type":"post","link":"https:\/\/tolinku.com\/blog\/onboarding-compliance\/","title":{"rendered":"Onboarding Compliance: COPPA, GDPR, and Age Gating"},"content":{"rendered":"\n

Compliance requirements affect onboarding directly. If your app could be used by children, you need COPPA compliance. If you serve EU users, GDPR consent must be collected during onboarding. Age gating, parental consent, data processing agreements, and privacy notices all need to be integrated into the onboarding flow without destroying the user experience.<\/p>\n\n\n\n

For security practices, see Security Best Practices for Fintech Deep Links<\/a>. For privacy-safe measurement, see Attribution Data Clean Rooms: Privacy-Safe Measurement<\/a>. For general onboarding best practices alongside compliance, see Onboarding Best Practices for Mobile Apps in 2026<\/a>.<\/p>\n\n\n\n

Age Gating<\/h2>\n\n\n\n

When Age Gating Is Required<\/h3>\n\n\n\n
\n\n\n\n\n\n\n\n
Regulation<\/th>\nApplies When<\/th>\nAge Threshold<\/th>\n<\/tr>\n<\/thead>\n
COPPA (US)<\/td>\nApp collects data from children<\/td>\nUnder 13<\/td>\n<\/tr>\n
GDPR (EU)<\/td>\nApp processes data of minors<\/td>\nUnder 16 (varies by member state, 13-16)<\/td>\n<\/tr>\n
AADC (UK)<\/td>\nApp likely accessed by children<\/td>\nUnder 18<\/td>\n<\/tr>\n
LGPD (Brazil)<\/td>\nApp processes children's data<\/td>\nUnder 18 (or 12 for "children" vs. "adolescents")<\/td>\n<\/tr>\n
PIPL (China)<\/td>\nApp processes minor's data<\/td>\nUnder 14<\/td>\n<\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n

Age Gate Implementation<\/h3>\n\n\n\n

A compliant age gate collects the date of birth without suggesting the "correct" answer:<\/p>\n\n\n\n

function AgeGate({ onVerified }) {\n  const [birthDate, setBirthDate] = useState(null);\n\n  function handleSubmit() {\n    if (birthDate === null) return;\n\n    const age = calculateAge(birthDate);\n\n    if (age < 13) {\n      \/\/ COPPA: Cannot collect data without parental consent\n      navigation.navigate('ParentalConsent');\n      return;\n    }\n\n    if (age < 16) {\n      \/\/ GDPR: May need parental consent depending on jurisdiction\n      navigation.navigate('MinorOnboarding', { age });\n      return;\n    }\n\n    onVerified({ age, birthDate });\n  }\n\n  return (\n    <Screen>\n      <Heading>Enter your date of birth<\/Heading>\n      <Text>We need this to provide the right experience for you.<\/Text>\n\n      <DatePicker\n        value={birthDate}\n        onChange={setBirthDate}\n        maximumDate={new Date()} \/\/ Cannot be in the future\n        \/\/ Do NOT set a minimum date that hints at the required age\n      \/>\n\n      <Button onPress={handleSubmit} disabled={birthDate === null}>\n        Continue\n      <\/Button>\n    <\/Screen>\n  );\n}\n<\/code><\/pre>\n\n\n\n
Anti-Gaming Measures<\/h3>\n\n\n\n
Prevent users from lying about their age:<\/p>\n\n\n\n
async function handleAgeVerification(userId, birthDate) {\n  \/\/ Store the attempt\n  await logAgeVerification(userId, birthDate);\n\n  \/\/ Check for repeated attempts (user going back and changing DOB)\n  const attempts = await getAgeVerificationAttempts(userId);\n\n  if (attempts.length > 1) {\n    \/\/ User tried to change their age \u2014 use the FIRST attempt\n    \/\/ This prevents children from going back and entering an older date\n    birthDate = attempts[0].birthDate;\n  }\n\n  \/\/ Persist permanently (cannot be changed in settings)\n  await setUserBirthDate(userId, birthDate, { locked: true });\n}\n<\/code><\/pre>\n\n\n\n
COPPA Compliance<\/h2>\n\n\n\n
What COPPA Requires<\/h3>\n\n\n\n
For users under 13 in the United States:<\/p>\n\n\n\n
    \n
  1. Verifiable parental consent<\/strong> before collecting, using, or disclosing personal information<\/li>\n
  2. Privacy notice<\/strong> specifically for parents<\/li>\n
  3. Limited data collection<\/strong> (only what's necessary)<\/li>\n
  4. Parental access<\/strong> to the child's information<\/li>\n
  5. Ability to delete<\/strong> the child's data<\/li>\n<\/ol>\n\n\n\n
    Parental Consent Flow<\/h3>\n\n\n\n
    function ParentalConsentFlow({ childAge }) {\n  const [step, setStep] = useState('notice');\n\n  return (\n    <View>\n      {step === 'notice' && (\n        <ParentalNotice\n          onContinue={() => setStep('verification')}\n        >\n          <Text>\n            Because you are under 13, a parent or guardian must\n            give permission for you to use [App].\n          <\/Text>\n          <Text>\n            We will collect your parent's email to send a consent request.\n          <\/Text>\n        <\/ParentalNotice>\n      )}\n\n      {step === 'verification' && (\n        <ParentalVerification\n          onSubmit={async (parentEmail) => {\n            await sendParentalConsentEmail(parentEmail);\n            setStep('waiting');\n          }}\n        \/>\n      )}\n\n      {step === 'waiting' && (\n        <WaitingScreen>\n          <Text>\n            We sent a consent request to your parent's email.\n            You can use [App] once they approve.\n          <\/Text>\n        <\/WaitingScreen>\n      )}\n    <\/View>\n  );\n}\n<\/code><\/pre>\n\n\n\n
    COPPA-Compliant Data Collection<\/h3>\n\n\n\n
    const COPPA_ALLOWED_DATA = {\n  \/\/ Can collect without parental consent (for internal use only)\n  persistent_identifier: true, \/\/ For app functionality\n  \/\/ Requires parental consent\n  name: 'requires_consent',\n  email: 'requires_consent',\n  location: 'requires_consent',\n  photos: 'requires_consent',\n  \/\/ Never collect from children\n  behavioral_advertising_data: 'prohibited',\n};\n\nfunction getOnboardingFieldsForAge(age) {\n  if (age < 13) {\n    \/\/ Minimal onboarding, no personal data collection\n    return {\n      fields: ['display_name'], \/\/ Pseudonymous\n      skip: ['email', 'phone', 'location', 'avatar_upload'],\n      requireParentalConsent: true,\n    };\n  }\n\n  return { fields: 'all', skip: [], requireParentalConsent: false };\n}\n<\/code><\/pre>\n\n\n\n
    GDPR Consent in Onboarding<\/h2>\n\n\n\n
    Consent Requirements<\/h3>\n\n\n\n
    GDPR requires that consent be:<\/p>\n\n\n\n