Where in COPPA does it say the DOB needs to be collected? I don't think that statement is true as you word it.
My memory of implementing COPPA compliance a decade ago was that DOB was an implicit requirement, the explicit requirement being “confirm they’re over 13; a checkbox isn’t good enough because they’ll clearly just lie.” (paraphrased, not quoted).
Thank you for explaining that for me.
That's what I had thought. However, users will lie about a DOB if they will lie about an age.
Does that mean you have to retain it beyond the initial check?
No idea. UK games company, so UK data protection act also applied, which I think actually forbids retaining any more than strictly necessary.