How would you verify an optional parent–teen account link without granting access from household signals?

Example answer

Start with the specific permission being requested. A family label, authentication to an account and verified authority to manage another person's settings are different claims. Shared IP addresses, devices, payment methods or interaction patterns establish none of those permissions on their own.

Use a user-initiated invitation with clear, age-appropriate explanations. Authenticate each account through the service's approved flow and obtain the confirmations required for the chosen feature. Authentication establishes control of an account; it does not by itself establish a legal family relationship. Any authority verification must use a purpose-specific process approved by privacy/legal and child-safety teams. Collect only the evidence necessary, restrict access and retention, and avoid showing sensitive account existence to an unverified inviter.

Keep permissions narrow and visible, notify affected users of changes, and provide an appropriate dispute, recovery and revocation process. Test shared devices, siblings, mistaken invitations, estranged families and compromised accounts. Do not silently create a link from predictive analytics or treat acceptance of an invitation as universal proof of guardian authority.

For this 13–17 case, do not claim that COPPA is a blanket teenage-consent rule. COPPA has under-13 and service-scope conditions; other requirements may apply. A service discovering an under-13 user needs its approved age-handling process.

Assessment signals

A strong response separates proof of control, relationship and permission; minimizes disclosure; handles revocation and abuse; and measures unauthorized links and complaints alongside completion.

References

NIST: authentication, FTC: COPPA applicability and requirements