2

I'm developing a site that requires a user's birthday (both to validate they are over 18 and for use by other users).

Asking for a birthday with an email registration form is trivial. Simply just add the birthday field after the password, similar to Facebook:

enter image description here

The issue is that I also provide the ability to login with Google and Facebook via OAuth. Previously (before asking for birthday) this was just a simple click of the Login with Google button. It would redirect you to the Google page and you would click Okay, and that was it. Very simple.

However, now I would like to also obtain the user's birthday from the OAuth login. Enabling this scope explodes the friction required to login with Google and Facebook. It seems like previously (some years ago), this information was automatically provided, but now there are an additional two prompts in order to obtain this information. They look like this:

enter image description here

enter image description here

I really don't like the UX behind this. The simple change of going from asking for First Name, Last Name, Email Address, Account ID, Profile Picture, Email Address Confirmed, etc. to just including Birthday in that list incurs a huge UX penalty in the form of two additional scary prompts that you have to click Yes to.

Personally, I wouldn't create an account with this service having to go through all these extra scary prompts.

Really, I do not need birthday to be that accurate. And users are able to change it later anyways. Personally I'd be fine with the flow of enter in some random BS birthday -> later update it in my profile when I realize it would benefit me. I've asked several users as well and they've confirmed this general strategy.

So, as unfortunate as it is, I think I probably am going to want to abstain from using Google's scary prompts, but I'm unsure of how to integrate an alternative. The only thing I can think of is instead having the Google OAuth redirect to a page that asks for your birthday, but this seems so complex. Having a multi-page registration just for a measly birthday field? There has to be a better way, right?

I'm currently at a loss for how to handle this.

| improve this question | | | | |
2

"two additional scary prompts that you have to click Yes to"

Well, the User can uncheck the checkmark in your example. The worst you could do is fail to handle the scenario where the user unchecks that checkmark (a lot of sites/systems fail that). Most people are familiar with the Oauth flow that gives them the heads-up on what personal data will be shared between services. Your interpretation of scary is not the same as the next person's. Similarly, not everyone is scared of spiders.

"I do not need birthday to be that accurate"

Oh, so you aren't doing this to comply with some age restriction compliance requirement? You probably should, but it depends on the nature of your system and its content.

"Personally I'd be fine with the flow of enter in some random BS birthday -> later update it in my profile when I realize it would benefit me"

So choose for the user, get it wrong, make it obvious to the user, then relying on them caring about it enough to go and update it. If it is wrong, well...who knows what purpose you are actually using it for?? What are you actually using the "inaccurate birthday date" for?

"users are able to change it later anyways."

Really? In your system or in Facebook/Google? If they can change it later in your system, why not leverage that existing mechanism? E.g. auto-navigate to that mechanism upon first-time signin (or subsequent signins if not yet entered).

Sounds like the most important thing you need to focus on is having the User accept terms of service (and privacy policy) prior to registration. Requiring (in those terms) that Users are over the age of 18 and capturing their acceptance of the terms means you can create the account without having the birth date value. You can't both accept an inaccurate birth date and require users to be over the age of 18 prior to creating the account and prove that with an inaccurate birth date. If you really need the birth date to prove their legitimacy, then you need a KYC flow (probably involving the collection and acceptance of a proof of identity card|driver's license|etc).

| improve this answer | | | | |
  • I can't auto-navigate to it on first sign-in because they need to be over 18. If at that point they aren't 18, it's too late, because they already have an account. Technically the minimum age legally for what I'm building is 13, but I personally am making it 18. – Ryan Peschel Mar 6 at 2:11
  • You should rely on Google and Facebook's data, they do it better and you somewhat outsource the risk by relying on them. It sounds like you would do it wrong, given the chance. – straya Mar 6 at 2:20
  • It's fine to ask for it and trust the user because I am already doing that in the case of of registering with email. Similar to Facebook, you can just pick a birthday and register with that. I don't like how many hoops I have to go through to provide a worse UX with OAuth (3 prompts.. seriously?) than the email registration form. – Ryan Peschel Mar 6 at 2:27
  • Oh, I forgot to mention - Not relying on Google is potentially even better because I personally used a fake birthday when registering with Google initially (January 1st 1970 or something). I know many other people did as well. And for this service it will be in the user's best interest to provide an accurate birthday (they will want to for selfish reasons), so I feel like I'm going to have to provide for this option regardless (because their Google birthday may be incorrect) – Ryan Peschel Mar 6 at 2:29
  • added a paragraph to the end of my answer (as comment was too long) – straya Mar 6 at 2:58
0

With all that you said, it's clear that you should just be presenting a "You must be older than 18 years, please enter your birth day" form first and foremost and take birth date out of the OAuth process.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.