Designing children's privacy, age verification, and parental consent UI in Figma: gates, guardians, and COPPA/GDPR flows

Quick answer

Children’s privacy UI combines age verification at signup, parental consent for under-threshold users, and stricter defaults for data collection—design must work for kids, parents, and regulators without dark patterns. Build an age gate with jurisdiction-aware thresholds; a parent/guardian verification and consent flow (email plus, card, or ID where required); and a guardian dashboard to review, limit, or delete a child’s data. Start from the Figma guides hub and pair with privacy settings, consent admin, cookie consent, launch gates, and Dev Mode handoff.

---

Who this is for

• Product designers building family, education, gaming, or social products that may serve users under 13–16 depending on region.
• Design system teams standardizing age badges, restricted-mode banners, and guardian-only controls.
• Privacy and Trust teams implementing COPPA, GDPR-K, UK AADC, and similar frameworks with auditable consent—not a birthday field buried in settings.

---

Age verification hub (internal overview)

MinorPrivacyHub — Acme Family · 2.1M accounts · 84k minor-linked · 312 pending parental consents
├── Header: Under-13 blocked 12k attempts · Pending consent 312 · Guardian verified 98.2%
├── Actions: [ Configure thresholds ] [ Consent report ] [ Export regulator pack ] [ Review appeals ]
├── Tabs: Age gates · Parental consent · Guardian accounts · Minor defaults · Jurisdiction rules · Audit
├── Alert: US-CA threshold 16 for sale of data · Rule JR-08 updated Jul 30 · Banner sync pending
├── Filters: Region · Age band · Consent status · Product surface · Verification method
└── Link: [Consent admin](/designing-consent-records-and-preference-management-admin-ui-in-figma/) · Privacy settings · ROPA · Trust center

Section	Purpose
Age gates	Entry flows and re-prompt rules by jurisdiction
Parental consent	Pending, verified, expired, and revoked consent cases
Guardian accounts	Linked parent/guardian with permissions over child profile
Minor defaults	Feature flags and data collection OFF by default
Jurisdiction rules	COPPA 13, GDPR-K 13–16, UK, US state variants
Audit	Evidence for FTC, ICO, or CNIL inquiries

Verdict: Children’s privacy UI fails when age is collected but never enforced—gates must change product behavior, not just store a date.

---

Age gate flow (customer-facing)

AgeGate — Welcome to Acme Kids · Before we continue
├── Step 1 — Date of birth:
│   ├── Input: Month / Day / Year · Accessible labels · No pre-filled adult default
│   ├── Under threshold (e.g., under 13 US): Route to Parent flow · Do NOT create full account
│   └── Over threshold: Continue to standard signup · Log jurisdiction rule applied
├── Step 2 — Jurisdiction hint (if IP/locale ambiguous):
│   └── "Where do you live?" · Dropdown · Determines consent age (13 vs 16)
├── Blocked state — Under age:
│   ├── Copy: "You need a parent or guardian to create an account"
│   ├── [ Continue with parent email ] · No alternate bypass link
│   └── Optional: Downloadable info for parents · Link [trust center](/designing-trust-center-and-security-documentation-ui-in-figma/)
└── Re-prompt: Suspected false DOB · Soft challenge before enabling social features

Pattern	Requirement
No dark patterns	No “I’m 18+” link for under-age users to self-certify falsely
Minimal data pre-consent	Collect DOB only; defer email until parent path clear
Clear next step	Parent email entry with expected timeline
Accessibility	Date inputs labeled; errors not color-only
Logging	Store rule version and outcome for audit—not raw DOB in analytics

Age gates at signup only are insufficient—re-verify before enabling chat, payments, or public profile.

---

Parental consent and verification flow

ParentConsent — Child request from child_991 · Pending · Sent Aug 7, 2026
├── Child context: Display name "Alex" · Age band 10–12 · Product Kids Reading App
├── Parent entry: email parent@example.com · [ Send verification ]
├── Verification methods (jurisdiction-configured):
│   ├── Email plus (COPPA common): Click link + enter code
│   ├── Credit card micro-charge (where permitted): $0.50 verify · Refunded
│   ├── ID document (high-risk regions/products): Vendor SDK · Privacy notice link
│   └── Already verified guardian: Skip if same household token valid
├── Consent screen (parent must affirm each):
│   ├── ☑ I am the parent/guardian · Name field required
│   ├── ☑ I consent to account creation and core service data
│   ├── ☐ Optional: Progress reports email · Default OFF
│   ├── ☐ Optional: Personalized recommendations · Default OFF · Link [consent ledger](/designing-consent-records-and-preference-management-admin-ui-in-figma/)
│   └── Plain-language summary: What we collect · Retention · Parent rights
├── Outcomes: Verified → Create child account · Denied → Notify child · Expired → Resend
└── Record: Consent ID PC-4421 · Method email_plus · Policy v4.3 · Timestamp UTC

Step	Compliance note
Separate parent identity	Parent email ≠ child login when possible
Granular optional consents	Marketing and profiling OFF by default
Affirmative action	No pre-checked boxes for non-essential processing
Policy version	Bind to policy version
Revocation path	Link to guardian dashboard from confirmation email

Verification method must match regulator expectations for your product category—document choice in ROPA.

---

Guardian dashboard

GuardianDashboard — Parent @guardian_220 · 2 linked children
├── Child: Alex (10) · Active · Last active Aug 7 · [ Manage ]
│   ├── Privacy: Profile visibility Friends only · Chat disabled · Location off
│   ├── Data: [ Download child's data ] [ Request deletion ] · SLA 30 days
│   ├── Consents: Core service On · Progress email Off · Ads Off
│   ├── Activity summary: 4h this week · No flags · [ Detailed report ]
│   └── Actions: [ Pause account ] [ Revoke consent ] [ Transfer to other guardian ]
├── Child: Sam (14) · Teen mode · Regional threshold 16 for marketing
│   └── Graduated controls: Sam can adjust some prefs · Guardian notified
├── Add child: [ Link existing with code ] [ New consent flow ]
└── Help: What data we collect · [DSAR for child](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/) · Contact Privacy

Control	Default for under-13
Public profile	Off or friends-only
Direct messages	Off or restricted
Location	Off
Personalized ads	Off
Analytics	Strictly necessary only
Third-party SDKs	Blocked via app approvals

Teen bands (13–15) may allow graduated autonomy with guardian notification—not identical to adult defaults.

---

Minor account experience (restricted mode)

MinorHome — Alex · Kids Reading · Restricted mode banner visible
├── Banner: "Parent-managed account" · [Learn what this means] · Non-dismissible on first visit
├── Features hidden: Social share · Public leaderboard name · In-app purchases
├── Allowed: Reading progress · Assigned books · Teacher-linked classroom (school B2B path)
├── Upgrade prompts: None for social features · No "ask parent" nag loops every session
├── Support: In-app help uses plain language · No external links without guardian gate
└── Exit: [ Sign out ] · No account deletion without guardian (link to parent email)

Restricted mode should be visually calm—avoid shame copy (“kids account”) while making limits understandable.

---

Jurisdiction rules configuration (admin)

JurisdictionRules — 18 active · Last sync Aug 1, 2026
├── US COPPA: Age 13 · Parental consent required under 13 · Methods: email_plus, card
├── US-CA CPRA minors: Under 16 · No sale/share without opt-in · Link [privacy settings](/designing-privacy-settings-and-data-management-ui-in-figma/)
├── EU GDPR-K: Consent age 16 (DE) · 13 (IE) · Configurable per member state
├── UK AADC: High privacy defaults under 18 for applicable services
├── Feature blocks under threshold: Behavioral ads · Profiling · Geolocation · DM open
└── [ Simulate user ] [ Publish rules ] [ Notify Legal ] · Blocks [launch gate](/designing-privacy-by-design-launch-gates-and-feature-privacy-review-ui-in-figma/) if unset

Region	Typical consent age	Design implication
US COPPA	Under 13	Full parental consent
EU (varies)	13–16	Country picker or geo rule table
UK	13 + AADC	Defaults for under-18
US states	13–18 for sale/share	Extra toggles for teens

Rules engine outputs must feed feature flags—not rely on client-only checks.

---

Integration with consent and DSAR

ComplianceLink — Minor account child_991
├── Consent record PC-4421 · Purpose Core service · Parent guardian_220 · Policy v4.3
├── Optional purposes: All denied at creation · Change requires guardian re-auth
├── DSAR: Parent-initiated export includes child data · Redact other household members
├── Deletion: Guardian request · 30-day SLA · Cascade to backups per [retention policy](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)
├── ROPA PA-402 Children's accounts · Lawful basis Consent · DPIA DPIA-2024-01 linked
└── [ Open in consent admin ] [ Launch gate FEAT-720 Kids chat ] · Blocked pending DPIA

Children’s features should auto-open launch gates and DPIA on any new data type or social feature.

---

Handoff checklist (Dev Mode)

• AgeGateResult — session_id, jurisdiction_rule_id, outcome (adult/minor/blocked), threshold_applied, verified_at.
• ParentalConsent — id, child_request_id, guardian_email, method, status, policy_version_id, consented_purposes[].
• GuardianAccount — id, user_id, verification_method, linked_child_ids[].
• ChildAccount — id, guardian_id, age_band, restricted_mode, feature_flags, created_at.
• JurisdictionRule — id, region, min_consent_age, blocked_features[], allowed_verification_methods[].
• ConsentPurpose — id, key, label, default_for_minor, requires_guardian_reauth.
• Accessibility — age inputs screen-reader friendly; consent checkboxes large tap targets; plain language grade 6–8 for child surfaces.

---

Common mistakes

Mistake	Why it hurts	Fix
Birthday in settings only	COPPA bypass at signup	Gate before account creation
Pre-checked marketing consent	Regulatory violation	Opt-in only for non-essential
Child email as parent	Cannot prove parental consent	Separate guardian verification
Same defaults as adult	Excessive data collection	Minor profile template
”Enter parent email” with no follow-up	Orphan pending requests	Expiry, resend, and status UI
Social features before consent	Under-age exposure	Hard feature flags
No guardian revocation	Cannot withdraw consent	Dashboard delete/revoke
Age gate once	Teen lies at signup	Re-prompt at high-risk actions
ID verification with no DPIA	High-risk processing undocumented	Link DPIA in launch gate

---

Recommended workflow

1. Map jurisdictions your product serves and configure consent ages plus blocked features.
2. Design age gate before any PII collection with blocked under-threshold path.
3. Build parental consent flow with verification method, granular purposes, and policy version binding.
4. Create guardian dashboard for review, download, pause, and delete.
5. Apply minor defaults to feature flags, cookie banner, and analytics.
6. Wire consent records to consent admin and ROPA activities.
7. Gate new children’s features through privacy launch review with DPIA triggers.

---

FAQ

COPPA vs GDPR-K age thresholds?

COPPA focuses on under-13 in the US with parental consent. GDPR-K sets member-state ages (often 13–16) for consent to information society services—use jurisdiction rules table.

Can teens consent themselves?

Depends on region and purpose—some allow 13+ with enhanced defaults; marketing often still needs guardian or is blocked until 16.

Link to DSAR portal?

Guardians submit on behalf of children—verify guardian relationship before export or deletion.

School / B2B classroom accounts?

Often school as controller—design separate flow with institution admin, not consumer parental consent.

Cookie consent for minors?

Strictly necessary only by default; no non-essential cookies until guardian opts in where required.

---

Next steps

• Design privacy by design launch gates and feature privacy review UI in Figma — block children’s features without DPIA
• Design consent records and preference management admin UI in Figma — store parental consent evidence
• Design privacy settings and data management UI in Figma — guardian and teen privacy controls
• Design cookie consent and tracking preference UI in Figma — minor-appropriate defaults
• Design data subject access request and GDPR portal UI in Figma — guardian-initiated access and deletion