Camera access starts only after the browser permission prompt. The scan is local play; parents or guardians should supervise.