NIST Privacy Framework, Control-PCT.DP-P4

Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.

Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.

Build the record so that insured persons can consent to access to specific documents and data sets or to groups of them, and so that access by authorized care providers is limited by default to one week (Section 342, paragraph 2).

Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary.

Do not require government ID or biometric data to do so.

As a developer, request a signal when an application is downloaded and launched, treat the signal as the primary indicator of a user's age absent clear and convincing contrary information, and do not request more information than the minimum needed.

If you provide a very large online platform and require users to authenticate to access your service, also accept and facilitate the use of European Digital Identity Wallets for that authentication, only at the user's voluntary request and for the minimum data the service needs.

Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond that

Apply default privacy settings and limit profiling, targeted advertising, and precise-geolocation collection for a known minor user, and provide parental controls.

Do not require a child to disclose more personal information than is reasonably necessary to take part in a game, the offering of a prize or another activity.