This answer contains spoilers… (view spoiler)[To say that she should have been forced to use a female avatar for any reason, whether she is underage or not, is assuming a social construct that is not necessarily present in the narrative, especially because it ignores the powerful social message behind why she felt the need to do so. (hide spoiler)]
This answer contains spoilers… (view spoiler)[since school avatars had to be humanoid but OASIS ones weren't limited, it's possible she had two main skins. she was registered at school under a fake name and fake address, so maybe she just fibbed on the gender too. (i don't remember the fake name, but i'm pretty sure it was male.) (hide spoiler)]
Blake My guess is that she was adept at hacking her rig. Also, throughout the story they bring up the age old conversation of MMORP gamers, that female toon is probably a dude, and most of the time it is. So I don't think the avatar skin was a hard and fast rule. But you do bring up a potential gap in the story.