Your attorney will have more to say about this than I, but you'll find that it's the collection of information that is the relevant trigger, and not the consequential use of such information (e.g. marketing activities).

Collection of e-mail address from a <13 minor probably will be enough to trigger COPPA even if it's only used for authentication.  Many sites require a registering user to affirm that they are over thirteen years of age as a condition of registration to avoid these headaches.  If you cannot require such, then you'll have to deal with the additional verifiable parental consent that is required.

As a general rule, order an extra box of checks when attorneys and developers are required to interact.

Brandon

Hi Patrick,

Sounds like you're on the right track.  Just remember that collection of most information requires verifiable parental consent before that information is collected.  I believe there is an exception for the collection of a <13's e-mail address when used in certain situations.

Brandon