Technically it's not spelled out, but chances are Utah law enforcement / regulators won't accept a tech company's measures if a kid can just say another one of their own emails is their parents' and can then consent to the social media access themselves. Everyone affected by this will likely outsource it to a company like Stripe with their Identity product, where you're entrusting Stripe to do the ID verification and to delete the data once it's been verified.