The Consent Record Checklist – Mathew's Library

01 Three questions

On October 13, 2026, a proposed class action against OpenAI said the ChatGPT sign-up asks a name, an age over 13 and a click on Continue, while OpenAI's own Terms of Use say anyone under 18 needs a parent's or guardian's permission. Those are allegations; OpenAI calls the lawsuit misguided, and no court has ruled. The questions underneath apply to any business a minor can reach.

Who verifies age? A typed age is a statement, not a verification. Verifying means you did something to check: a payment, an ID, a signal from a source you trust. Most businesses don't need to verify everyone, but you need to know which one you're doing, and say it honestly in your own policy.

What does your 13+ checkbox prove? That someone clicked. Not how old they are, and not that any parent was ever asked.

Who holds the consent record? If a parent did say yes, can you show it, or does the record sit with your form tool, chat widget or AI platform?

02 The five things in a consent record

If all you store is the age field and a timestamp, you have a statement. A real consent record has five things. Pick one real user and try to fill this in:

Consent record

User: [ID or email]
1. Date of consent: [date]
2. Which parent: [name, relationship]
3. What they agreed to: [what data, what use]
4. Which version of the terms they saw: [version or date]
5. How you checked it was the parent: [method]
Where this record lives: [our system / vendor name]
Can we pull it on request? [yes / no]

If you can't fill in all five, you don't have consent. You have a statement.

03 The five checks

List every door. Every chatbot, form, quiz, contest, app and funnel a minor could reach, including the ones you don't think of as being for kids. For a B2B company: the quiz, the lead magnet, the webinar signup, the chatbot on the pricing page.

Read your age screen like a stranger. What does it ask? Does it default to an age? Does it hint at the right answer, for example by showing the minimum age before you answer? What happens when someone types twelve?

Find one consent record. Pick a real user and try to produce the five things above.

Trace the data. What does a minor type or upload, and where does it go: your vendor, a training setting, memory, analytics, retention? Read the vendor's terms and find the delete path.

Write one page. Which ages you serve, what happens when someone says they're under 13, and who is accountable. Then take it to a lawyer.

04 Two rules, two ages

Under 13 is federal. COPPA is the US children's privacy rule enforced by the FTC. It defines a child as under 13 and requires verifiable parental consent before collecting a child's personal information, by a method reasonably calculated to make sure the person consenting is the parent. The methods it lists include a signed form, a payment that notifies the account holder, a call with trained staff, a video call or a government ID check; email works only with extra steps. None is a child's own click. When a service asks for age, it should ask in a neutral way that doesn't default to a set age or encourage people to falsify it. The updated rule's main compliance date was April 22, 2026.

13 to 17 is different. That's where the lawsuit's California contract theory lives (Civil Code section 1568.5: a minor saying a parent consented is not consent), and it hasn't been decided. California's Digital Age Assurance Act (AB 1043) becomes operative on January 1, 2027: operating systems will ask for an age at setup and give apps an age range, and an app that requests that signal is treated as knowing the range.

Not legal advice. This is a list of questions to bring to a lawyer, not an answer on whether your form complies.

05 Questions for your lawyer and your vendors

Which ages can reach us, and which of the two rules applies to each door? Is our age screen neutral: no default age, no hint at the answer? When someone says they're under 13, what happens, and is that written down? For each form tool, chat widget or AI platform: does the consent record sit with them or with us, and can we pull it? What is the least data we can hold instead: a dated record, the parent's confirmation through a channel we control, the minimum collected, and a plain way to delete it?

Sources

Complaint, Doe v. OpenAI Foundation, No. 3:26-cv-11781 (N.D. Cal.), filed October 13, 2026 Bloomberg Law: OpenAI sued for taking minors' data without parental consent 16 CFR 312.5, Parental consent (COPPA Rule) 16 CFR 312.2, Definitions (COPPA Rule) Davis Polk: the amended COPPA Rule's compliance date Kelley Drye: FAQs on California's Digital Age Assurance Act (AB 1043)

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.