How to ask for user's birth date with OAuth?

Question

I'm developing a site that requires a user's birthday (both to validate they are over 18 and for use by other users).

Asking for a birthday with an email registration form is trivial. Simply just add the birthday field after the password, similar to Facebook:

The issue is that I also provide the ability to login with Google and Facebook via OAuth. Previously (before asking for birthday) this was just a simple click of the Login with Google button. It would redirect you to the Google page and you would click Okay, and that was it. Very simple.

However, now I would like to also obtain the user's birthday from the OAuth login. Enabling this scope explodes the friction required to login with Google and Facebook. It seems like previously (some years ago), this information was automatically provided, but now there are an additional two prompts in order to obtain this information. They look like this:

I really don't like the UX behind this. The simple change of going from asking for First Name, Last Name, Email Address, Account ID, Profile Picture, Email Address Confirmed, etc. to just including Birthday in that list incurs a huge UX penalty in the form of two additional scary prompts that you have to click Yes to.

Personally, I wouldn't create an account with this service having to go through all these extra scary prompts.

Really, I do not need birthday to be that accurate. And users are able to change it later anyways. Personally I'd be fine with the flow of enter in some random BS birthday -> later update it in my profile when I realize it would benefit me. I've asked several users as well and they've confirmed this general strategy.

So, as unfortunate as it is, I think I probably am going to want to abstain from using Google's scary prompts, but I'm unsure of how to integrate an alternative. The only thing I can think of is instead having the Google OAuth redirect to a page that asks for your birthday, but this seems so complex. Having a multi-page registration just for a measly birthday field? There has to be a better way, right?

I'm currently at a loss for how to handle this.

Answer 1

"two additional scary prompts that you have to click Yes to"

Well, the User can uncheck the checkmark in your example. The worst you could do is fail to handle the scenario where the user unchecks that checkmark (a lot of sites/systems fail that). Most people are familiar with the Oauth flow that gives them the heads-up on what personal data will be shared between services. Your interpretation of scary is not the same as the next person's. Similarly, not everyone is scared of spiders.

"I do not need birthday to be that accurate"

Oh, so you aren't doing this to comply with some age restriction compliance requirement? You probably should, but it depends on the nature of your system and its content.

"Personally I'd be fine with the flow of enter in some random BS birthday -> later update it in my profile when I realize it would benefit me"

So choose for the user, get it wrong, make it obvious to the user, then relying on them caring about it enough to go and update it. If it is wrong, well...who knows what purpose you are actually using it for?? What are you actually using the "inaccurate birthday date" for?

"users are able to change it later anyways."

Really? In your system or in Facebook/Google? If they can change it later in your system, why not leverage that existing mechanism? E.g. auto-navigate to that mechanism upon first-time signin (or subsequent signins if not yet entered).

Sounds like the most important thing you need to focus on is having the User accept terms of service (and privacy policy) prior to registration. Requiring (in those terms) that Users are over the age of 18 and capturing their acceptance of the terms means you can create the account without having the birth date value. You can't both accept an inaccurate birth date and require users to be over the age of 18 prior to creating the account and prove that with an inaccurate birth date. If you really need the birth date to prove their legitimacy, then you need a KYC flow (probably involving the collection and acceptance of a proof of identity card|driver's license|etc).

Answer 2

With all that you said, it's clear that you should just be presenting a "You must be older than 18 years, please enter your birth day" form first and foremost and take birth date out of the OAuth process.