IANAL, but let's see what COPPA has to say about accounts belonging to users under 13 years of age:
In the FAQ, under section A-3:
- A screen or user name that functions as online contact information;
- A persistent identifier that can be used to recognize a user over time and across different websites or online services;
Check! A SO profile qualifies as PI.
So, what if someone lies about their age? Section A-12 of the FAQ has us covered:
Will the COPPA Rule prevent children from lying about their age to register for general audience sites or online services whose terms of service prohibit their participation?
No. COPPA covers operators of general audience websites or online services only where such operators have actual knowledge that a child under age 13 is the person providing personal information. The Rule does not require operators to ask the age of visitors. <...> If, however, the operator later determines that a particular user is a child under age 13, COPPA’s notice and parental consent requirements will be triggered. <...>
This means that you don't have to pro-actively confirm a user's age, but if you find out they're under-age, COPPA rules apply, which mean you can't store their PI.
Then what?
We flip to section B-4 op the FAQ:
What should I do if my website or app doesn't comply with the Rule?
First, until you get your website or online service into compliance, you must stop collecting, disclosing, or using personal information from children under age 13. <...>
Basically, get rid of the PI data (the account) and you're good. There are some instructions in there to review how the situation came to be, but that's a broader subject than this case.
Note that "Get rid" means complete deletion from the database / log files etc.