If a web client (fridge, infotainment system, alexa, etc...) can access the internet then it must be updated to look for RTA/adult headers and prompt for an admin password for parental controls to approve access to the site.
Another option of course is to force all these companies and their age/ID vendors to be under something much stricter than PCI DSS and Fedramp for their entire data-centers as a starting point if we must allow storing PII data of children and their parents.