[whstl]

> What is the alternative?

Asking for a CC, password, fingerprint/passkey, authenticator, email confirmation?

[jmb99]

If the CC is stored in autofill, as is the password, and the child has access to the device (presumably through biometrics), then none of those prove an adult clicked “Buy.”

[whstl]

Still, there is no need to throw the baby with the bathwater.

If you’re claiming that no security is possible, might as well allow anyone to login on any account.

Alternatives DO exist.

[supermatt]

And even then, you are still protected by law if it is a child that makes the purchase.