Skip to main content

Verifiable Parental Consent (VPC)

Verifiable Parental Consent (VPC) is a regulatory requirement that ensures parents or trusted adults can provide informed consent for children to access digital content, services, or features. When a child attempts to access age-restricted content, the system creates a Challenge that requires parental approval before access can be granted.

What's VPC?​

VPC is a legal requirement in many jurisdictions (such as COPPA in the United States and GDPR-K in the European Union) that requires platforms to obtain verifiable consent from parents or guardians before collecting, using, or disclosing personal information from children under a certain age.

The VPC flow typically involves:

  1. Age Collection: Determining the child's age through appropriate methods
  2. Challenge Creation: Creating a consent challenge when parental approval is required
  3. Parental Notification: Notifying parents through various channels (email, QR code)
  4. Consent Processing: Parents review and approve/deny the request
  5. Session Management: Creating or updating the child's permissions based on consent results

When's VPC required?​

VPC is required when:

  • A player's age is below the digital consent age in their jurisdiction
  • A player attempts to access features or content that require parental consent
  • Regulatory requirements mandate parental consent for data processing

The /age-gate/check API automatically determines whether VPC is required based on the player's age and jurisdiction. If VPC is required, the API returns a CHALLENGE status with challenge information.

VPC workflow​

Step 1: Age gate check​

When a player provides their age, call /age-gate/check with the player's date of birth and jurisdiction. If VPC is required, the API returns:

{
  "status": "CHALLENGE",
  "challenge": {
    "challengeId": "<guid>",
    "oneTimePassword": "<one time password>",
    "type": "CHALLENGE_PARENTAL_CONSENT",
    "url": "https://family.k-id.com/authorize?otp=<one time password>"
  }
}

Step 2: Display challenge​

Show the consent challenge to the player, including:

  • QR code (rendered from the url field)
  • One-time password
  • Input field for parent/guardian email address

Step 3: Notify trusted adult​

If the player provides an email address, call /challenge/send-email to send a notification email to the trusted adult. The email contains a link to Family Connect where they can review and approve the request.

Wait for the trusted adult to complete the consent process. You can:

  • Use Webhooks to listen for Challenge.StateChange events (recommended)
  • Poll the /challenge/get-status API periodically

Step 5: Process result​

Once consent is granted or denied:

  • PASS: Retrieve the session ID and grant access to the player
  • FAIL: Restrict access and inform the player that consent was denied

Family Connect​

Family Connect is k-ID's parent portal where trusted adults can:

  • Review consent requests
  • Grant or deny consent
  • Manage permissions for their children
  • View and update consent settings across multiple games

Once a trusted adult is verified, they can manage consent for multiple children across many games in Family Connect without needing to verify again.

Trusted adult verification​

Before a trusted adult can grant consent, they must verify their identity. k-ID provides multiple methods for trusted adult verification:

  • Credit Card Verification: Verify using a valid credit card
  • ID Document Verification: Verify using government-issued ID
  • Social Security Number Verification: Verify using SSN (United States only)

These methods ensure that only legitimate adults can grant consent for children.

For information about what data is stored for kids and trusted adults, see Access, features, and consent.