Set the devices up well—and make telling you safer than hiding it

Online Safety for Children: A Practical UK Parent Guide

Online safety is not a single talk about strangers and it is not a perfect filter. Children learn, make things, play with friends and find community online. The risks travel through features: a public profile that makes a child discoverable, an unknown adult who can message, a conversation moved into private chat, an algorithm that repeatedly serves harmful material, a purchase path that hides pounds or a tool that can generate a convincing fake.

A parent does not need to master every app. You need a repeatable way to assess the account, a small set of family rules and the right first response when the child brings you something messy.

What UK rules protect children online now?

The Online Safety Act makes in-scope services responsible for systems that address illegal content and protect children from defined harmful content. Ofcom’s current rules require measures such as effective age checks for the most harmful content, safer recommendation systems, child-friendly reporting, blocking/muting controls and action when services become aware of harm. These duties cover social platforms, games, apps and sites accessible in the UK, including services based elsewhere.

The Act does not make a platform risk-free and it did not itself create a social-media minimum age. A child can still encounter harm through private messages, gaming voice chat, livestreams, group chats, search, AI tools and content sent by another user.

Use current platform protections, but keep household settings and conversations in place. The law sets duties for companies; it cannot know the child, the context or whether a message that looks friendly is becoming controlling.

Assess the features, not just the app name

The NCA and National Police Chiefs’ Council argue for a feature-based view because harm can move from one named platform to another. Before saying yes to an app, game, AI tool or connected device, inspect these functions:

A “kids” label is not enough. Check the service minimum age, app-store rating, privacy settings, contact defaults, paid features and reporting path. Age rating and minimum account age answer different questions.

The 20-minute family online-safety setup

1. Inventory every route online. Include phone, tablet, console, computer, smart TV, old Wi-Fi devices, school technology and devices used at another home.
2. Use separate child accounts with the correct birth date. An adult account can give adult content, spending, contact and privacy defaults.
3. Protect the email foundation. Use unique passwords/passkeys and two-step verification on adult and child email because email can reset other accounts. Keep recovery details current.
4. Set contact before screen time. Review messages, friend/follower requests, comments, voice chat, group adds, livestreams and who can see online status.
5. Reduce discoverability. Make the profile private where appropriate. Turn off contact syncing, public search, location tags and recommendations based on contacts if unnecessary.
6. Lock purchases and installs. Require adult approval, remove casual adult-card access and inspect subscriptions, gifting and in-game wallets. Follow the full in-game spending reset.
7. Review permissions. Camera, microphone, photos, contacts and precise location should be available only when a feature needs them.
8. Turn on the matching device controls. Our parental-controls comparison maps Apple, Google, Microsoft and Qustodio by household.
9. Practise the escape route. Together, find mute, block, report, leave group, reset recommendation feed and request-more-time controls.
10. Test as the child. Try an unknown contact, restricted download, purchase, wrong-age site and downtime. Repeat after a new device or major update.

Write down two trusted adults besides the parent, because a child may need help when the parent is unavailable—or may find one issue too embarrassing to bring home first. Include a teacher/safeguarding lead, relative, youth worker or Childline.

Parental controls: useful layers, never a substitute for trust

Controls can limit content, time, purchases, downloads and sometimes location or activity. Use operating-system tools first and add service-specific settings. Broadband controls cover home Wi-Fi, not automatically mobile data or another network. Console rules do not configure Discord; a phone limit does not configure a smart TV.

Tell the child what you can see and why. Collect the least activity data needed for the problem. Routine secret message-reading can drive a child to a second account and make disclosure feel dangerous. If there is a specific risk of exploitation or immediate harm, get safeguarding or police advice rather than buying a hidden tracker.

Change the plan as the child grows

Do not wait for a birthday to remove everything at once. Tie independence to demonstrated skills: the child can use privacy settings, identify a scam, leave an escalating chat and ask for help without being shamed.

Have the conversation a child will return to

The Children’s Commissioner’s 2025 guide, built with teenagers including young people with SEND, found that whether children tell an adult can depend on how they expect that adult to react. Talk before there is a crisis.

Questions that reveal more than “is everything fine?”

• “Show me the funniest or most useful thing you saw this week.”
• “Who can message you here, and has anyone moved a chat somewhere more private?”
• “What does this app keep trying to make you watch or buy?”
• “Has anyone made you feel you had to reply, keep a secret or prove something?”
• “If a friend got a threatening message or fake image, who could they tell?”
• “Which rule feels pointless, and what safer alternative would still solve my concern?”

Make three promises you can keep: the child will not be blamed for another person’s behaviour; you will listen before deciding consequences; and you will explain when another adult must be involved for safety. Do not promise secrecy if someone may be at risk.

A child may have broken a family rule and still need immediate protection. Deal with the danger first. Revisit the rule after the child knows that telling you was the right move.

Teach the feed, not only “fake news”

Ask what a post wants the viewer to feel and do. Anger, panic, envy and urgency are distribution tools. Look for the original source, date, evidence and what is cropped out. Search a claim outside the platform and compare a reputable independent source.

Recommendation systems learn from pauses, replays, searches, likes and shares. A child does not need to have followed an account for a feed to become narrow or upsetting. Use “not interested”, unfollow, block, clear/watch-history or feed-reset tools where offered. Follow high-quality accounts that add variety rather than trying to debate every bad recommendation.

Ofcom’s 2026 research found a gap between confidence and performance around AI images: among teenagers who said they were confident at recognising AI-generated content, a quarter could not identify the example shown. “It looks strange” is no longer a reliable test. Check provenance and corroboration.

AI chatbots, deepfakes and generated advice

AI can support writing, coding, accessibility and creative play. It can also confidently invent facts, mimic a voice, simulate intimacy, collect sensitive prompts or create a fake sexual image. Children may meet AI inside a familiar app without choosing a separate “AI product”.

Five family rules for AI

1. No private life dump. Do not enter full name, school, address, live location, passwords, health records, private images or another person’s secrets.
2. AI is not a trusted adult. It cannot replace a parent, teacher, clinician, counsellor, emergency service or Childline.
3. Check important answers. Use a reliable source for health, law, money, safety and school citations; ask where claims came from.
4. Do not create a person’s fake nude, voice or humiliating image. “It was generated” does not remove the harm and sexual images involving an under-18 can be illegal.
5. Tell early if a bot becomes sexual, threatening, manipulative or asks for secrecy. Save ordinary account/URL evidence, report the tool and involve an adult.

Childline’s Report Remove accepts fake sexual images or videos made with AI when they appear to depict the young person. The same protection-and-removal response applies even when no original nude existed.

Protect the child’s privacy—and the footprint adults create

The ICO points out that clicks, searches and shares reveal interests, friendships and routines. Together, review who can see posts, tag or message the child; which apps access location, contacts, camera, microphone and photos; personalised adverts; and data shared with AI tools.

Adults should check their own posts for school uniform/logo, house number, regular route, club timetable, medical details, real-time holiday location and a child’s embarrassing private moment. Ask before posting when the child can understand; respect “no”; and give relatives the same rule. A private audience reduces reach but cannot prevent screenshots.

What to do when something goes wrong

1. Check immediate safety. Does the person know the child’s location? Are they threatening to arrive, demanding a meeting, image or money, or saying anyone will be hurt? Call 999 for immediate danger.
2. Thank the child and slow the panic. Remove blame. Ask what has happened, on which service, whether it moved elsewhere and what the other person knows.
3. Preserve proportionate evidence. Note usernames, profile URLs, dates, transaction IDs and ordinary message text/screenshots. Do not forward, copy around or ask the child to send you a sexual image as proof. Follow CEOP, police, IWF or platform instructions.
4. Stop fresh access. Block contact after evidence needs are understood; leave unsafe groups; turn off location; change compromised credentials from an updated trusted device.
5. Use the correct specialist route. The table below prevents a child-sexual-abuse report being lost in an ordinary customer-service queue—or CEOP being used for a hacked game account.
6. Keep supporting after the report. Removal, blocking or a police report does not instantly remove fear, shame, school gossip or sleep problems. Agree who at school needs to know and check in again.

If someone threatens to share a sexual image

Treat a demand for more images, money or continued contact as coercion—not a debt the child must settle. Do not blame the child, negotiate with the offender or promise that paying will end the threat. Check immediate safety, preserve usernames/URLs/messages without spreading the image, report suspected sexual abuse to CEOP and use Report Remove for copies involving the under-18. Tell the school safeguarding lead if peers or school circulation are involved.

If money has been paid, contact the payment provider quickly as well. Block once the evidence/reporting route is clear, tighten privacy so the offender cannot reach friends and relatives, and warn those contacts not to engage with impersonation messages.

If the child’s account is hacked

1. Use the service’s official recovery page—never a contact who offers recovery in direct messages.
2. Secure the linked email first if it may also be compromised; change its password and turn on two-step verification.
3. Change the affected account password from a clean, updated device; sign out all other sessions.
4. Remove unknown recovery addresses, phone numbers, connected apps, forwarding rules and payment methods.
5. Tell contacts not to trust recent requests for money, codes, links or images.
6. Save unauthorised transaction details and contact the store/bank; report fraud through the relevant national route.

Notice patterns without diagnosing from one sign

A sudden fear of notifications, new secret contact, unexplained gifts or game currency, sleep loss, repeated checking, withdrawal, sexualised messages, blackmail, panic about an image or a feed dominated by self-harm/eating-disorder content deserves a calm check-in. None proves abuse or “addiction” by itself.

Open with what you observed: “You looked worried when that message arrived—do you want me beside you while you open it?” Ask about school, friendships and offline pressures too. If the child may harm themselves or someone else, seek urgent help; call 999 for immediate danger, or NHS 111 and select the mental-health option where available for urgent support.

Online-safety questions parents ask

Is social media currently banned for under-16s in the UK?

Not yet. The government has announced restrictions expected to begin in spring 2027, with regulations and implementation still being completed. Current platform ages, Ofcom protections and family decisions still apply now.

Should I read every message?

Routine secret reading can damage trust and produce more hidden accounts. Use supervision proportionate to age and a real concern, explain ordinary checks, and seek specialist advice when a concrete safeguarding risk may require different action.

What is the safest age for a first phone?

There is no single safe birthday. Decide which need the device solves and whether the child can follow contact, privacy, spending and help rules. A call/text watch or limited device may solve travel contact without opening every social feature.

Are age checks enough to keep a child safe?

No. They can reduce access to harmful content and adult environments, but do not replace account privacy, contact controls, reporting or a trusted adult.

Can parental controls stop every harmful message?

No. Controls are strongest at time, app, purchase and broad content rules. Private communication and context can escape automated filters, so configure each service and practise telling/reporting.

What if my child lied about their age?

Correct the account age where the service allows it or create a proper child account. Explain that the real age turns on protections. Keep the disclosure route open even if a family rule was broken.

Should a child use an AI chatbot for emotional support?

An AI tool can offer general information but is not a trusted adult, clinician or crisis service and may be wrong or manipulative. A worried child should contact a trusted person, Childline or appropriate health/emergency help.

Can Report Remove take an image out of WhatsApp?

It can help with public internet copies, including AI fakes, but Childline says IWF cannot remove encrypted-network messages such as WhatsApp or files saved on someone’s device. Report in the app and use CEOP/police routes when sexual abuse or threats are involved.

Should phones stay out of bedrooms overnight?

For many families, charging in a shared place protects sleep and reduces late-night pressure. Older teens may need a phone for travel or health; agree an alternative boundary and model it fairly.

Current UK rules, risks and help routes

1. Ofcom: 2026 parent guide to child-protection duties and safer services.
2. Ofcom: Children and Parents Media Use and Attitudes 2026.
3. GOV.UK: July 2026 fact sheet on future under-16 social-media restrictions.
4. GOV.UK: planned curfews and feature protections for older teenagers.
5. NCA and NPCC: feature-based risks across social, gaming, messaging and AI.
6. UK Kids Online Safety Hub: set up and test parental controls.
7. UK Kids Online Safety Hub: algorithms, misinformation and weekly content talks.
8. Children’s Commissioner: what children want parents to know about online life.
9. NSPCC: AI, privacy, misinformation, deepfakes and sextortion.
10. Information Commissioner’s Office: child privacy checklist.
11. National Cyber Security Centre: protect important accounts with 2SV.
12. NCA CEOP Safety Centre: report suspected online sexual abuse or grooming.
13. Childline and IWF: Report Remove for under-18 sexual images and AI fakes.
14. Internet Watch Foundation: anonymously report child sexual abuse imagery.
15. Report Harmful Content: platform routes for bullying, impersonation and other harms.
16. Report Fraud: cybercrime and fraud reporting in England, Wales and Northern Ireland.