Family Online Safety Guide for Every Age

A good family online safety plan is mostly about conversation, not control. Set up devices and accounts properly at the start, agree a few simple habits, keep talking so that anyone can say "something strange happened" without being punished, and review who can reach your accounts when family life changes. This guide covers each age and each moment in order.

It is written for parents, grandparents and adult children who look after someone else's phone as well as their own. You do not need a technical background. You need an hour for the setup, and a calm tone for the talking. Settings change as apps change, so we describe what to look for rather than which button to press. Where we mention authorities or support services, we mean the ones in your own country.

A child's first device

The first phone or tablet is the best moment to get things right, because nothing is set yet and nobody feels watched. Set it up together, in the open, as part of getting the device.

Start with an account that belongs to the child but sits inside a family arrangement. Most phone makers and app stores have a family or child account type. It lets a parent approve downloads, set age limits and see screen time. Do not hand over your own account. If the child uses your login, they can spend your money and see your messages, and you cannot tell whose activity is whose.

Before you hand the device over:

Set a screen lock the child can remember, and keep a record of it somewhere safe.
Turn on the find-my-device feature so a lost phone can be found or locked.
Turn off purchases without a password, so a game cannot spend money at the tap of a button.
Choose age limits for apps, films and websites that fit your child.
Check the privacy settings for each app they will use. Many apps start with public profiles and open messages from anyone.
Set the device to update itself.

Our guide on how to set up a child's first phone goes through these settings in order, and suggests the first conversation to have.

One honest point. Settings help, but no filter catches everything, and a child with a friend's phone is outside your settings. What protects children most is that they know they can tell you anything.

Habits that stick

Children copy what they see. If the adults in the house lock their screens, use different passwords and do not click on strange links, the children learn this as normal. Short, repeated habits work better than a long lecture.

Habits worth building:

Pause before you tap. If a message or pop-up makes you feel excited or scared, wait and ask.
Keep private things private. Full name, school, home address, daily routine and photos in school uniform are not for strangers.
Passwords are not shared, not even with best friends. A friend can become an enemy next term.
A stranger online is still a stranger, even after months of chatting.
Tell an adult when something feels wrong, and nobody will be in trouble for telling.

Agree household rules together, for example no devices at meals and phones charging outside the bedroom at night. Rules that the children helped to make are easier to keep. Make them apply to adults too.

Grooming, secrecy and pressure

This is the part parents fear, so it is worth being clear and calm. Some adults, and some older teenagers, pretend to be friendly peers in order to gain a child's trust. The pattern has common features. They flatter the child. They ask to move the chat to a private app. They ask for secrecy: "don't tell your parents, they won't understand". They give gifts, game items or money. Later they ask for photos or pressure the child.

The warning signs for a parent are not always technical. A child who suddenly hides the screen, gets upset after messages, has new gifts they cannot explain, or is staying up late secretly online may be under pressure from somebody. They may also be having an ordinary hard week. Do not jump to conclusions. Ask open questions in a quiet moment: "Is anyone online making you uncomfortable?" "Has anyone asked you to keep a secret?"

The most important thing to tell a child is this: if anyone online asks you to keep a secret from your parents, that is the sign to tell us, and you will never be in trouble for it. A child who fears punishment hides things. A child who expects help brings them.

If you fear a child is being targeted by an adult, keep the messages, do not confront the other person, and contact the police or your country's child protection reporting service. Your school's safeguarding lead can also advise.

Teenagers can also face a specific threat: someone tricks them into sending a private image, then threatens to share it unless they pay or send more. This is called sextortion. The teenager is the victim, not the offender. Our guide on what parents should do when a teenager faces sextortion explains the calm first steps: do not pay, do not delete, block and report, and get help from the proper services.

Gaming accounts and giveaways

Games are a social space as well as a pastime, and a game account often holds real money value in skins, items and saved cards. Criminals target them.

What to teach and set:

Use a unique password for the game account, different from the email password, and turn on two-step verification if the game offers it.
Never share an account login with someone who offers to "boost" your level or trade items.
Treat free currency, free skins and "giveaways" with suspicion. A link that asks you to sign in to claim a prize is a fake login page.
Keep payment cards off the account where possible, or require a password for each purchase.
Check voice and text chat settings. Many games let you limit who can talk to your child.
Talk about "friends" who only exist in the game, and what they ask for.

Here is an example. A boy of eleven gets a message in a game: "Free rare skin for the first 100 players, sign in here." The page looks like the game's. He types his username and password. An hour later he is locked out and his items are gone. The fix is not blame. It is a conversation: how to check an address, why a prize never needs your password, and how to recover the account with the help of the game's support.

Supporting an older relative

Many families end up helping a parent or grandparent with their phone, and many older people are targeted by scammers, because they often have savings and are told to trust official voices. The goal is to protect them while respecting that it is their life.

Start with an agreement, not a takeover. Ask: "If you ever get a call or a message asking for money or a code, would you call me first? Even if they say not to tell anyone?" Choose one person as their verification buddy. A short pause to call that person breaks the scammer's spell of urgency.

Practical help, done with their consent:

Help them block unwanted calls and filter junk email using the settings on their phone and email service.
Set up a password manager, or at least a written list kept in a safe place, so they do not reuse one password.
Turn on updates, a screen lock and bank alerts.
Ask the bank about options such as a trusted contact for unusual payments, if your country's banks offer one.
Review smart speakers, cameras and other devices in the house, and who can access them.

Our guide on how to help elderly parents avoid scams covers these steps and how to raise them without sounding like you are taking control.

Talking about scams without blame

How you speak matters more than what you know. If a relative falls for a scam, shame makes them hide it, and hiding makes the loss bigger. Lead with the idea that these scams are professional, and clever people fall for them.

Helpful phrases: "These are built by people who do this all day." "It could have happened to anyone." "Let's work out what to do now." Unhelpful phrases: "How could you be so silly?" "I told you so."

Share a recent scam story from the news or from your own inbox, as a shared curiosity: "Look at this text I got, what do you think?" Then you both practise noticing the signs. Teach a few universal rules: real organisations do not ask for gift cards, remote access to your computer, or your full password; urgency and secrecy are signs of a scam; and you can always hang up and call back on a number you already trust.

A family verification word helps with the voice-clone scam, where a caller who sounds like a child or grandchild begs for urgent money. Agree one word that only the family knows. A caller who cannot give it is not who they say. Our guide on checking a family member who calls asking for money is useful reading for the whole household.

Shared accounts and housemates

Homes share more than a roof. Streaming accounts, a family cloud plan, the Wi-Fi password, a smart doorbell, a car app and a shared photo album all need someone's login. Over time you lose track of who can reach what.

Do a household audit once in a while:

Write down every shared account and device.
For each, list who has a login and whether they still need it.
Give each adult and child their own login where the service allows, rather than one shared password.
Use a guest network for visitors and housemates' devices, separate from your own.
When someone leaves the household, remove their access the same day.

Shared passwords are the weak point. When five people know a password, any of them can pass it on, lose it or reuse it. A family password manager that lets you share items without showing the password helps, if your family will use it.

After a relationship ends

A break-up is also a security event. A partner or ex-partner may know your passwords, may have set up your phone, may be on your family plan, and may still see your location or your photos. Most of the time this is carelessness, not malice, but it still needs to be closed.

Work through it in order. Make a list of every account, device and subscription you shared. Change passwords starting with email, then banking, then everything else, and sign out other sessions. Check your recovery email and phone numbers, and your security questions. Look for shared plans, smart home links, car apps and location sharing. Check for devices or apps the other person installed. Our guide on removing an ex's access to your accounts gives the complete method.

If the person has been controlling, threatening or watching you, your safety matters more than the technical steps. Changing everything at once can alert them. Contact a domestic abuse support service or the police in your country, and ask them how to do it safely. Do not rely on a guide alone.

Common mistakes

Using your own account for the child. Create a child account instead.
Setting rules and never explaining them. Children bypass rules they do not understand.
Reacting with anger when something goes wrong. The next problem will be hidden from you.
Doing everything for an older relative. They stop learning, and they stop telling you.
Sharing one password with the whole house. Give people their own access.
Forgetting old access. Former housemates, partners and visitors often still have it.
Believing a filter is enough. Tools help, talking protects.

Questions people ask

At what age should a child get a phone?

There is no single right age. It depends on the child, your family and the rules where you live. Many parents start with a basic device or a shared family tablet, then move to a phone when the child can follow agreed rules. Whatever the age, set it up together first.

Should I read my child's messages?

That is a family decision. Some parents agree on occasional checks that the child knows about. Secret monitoring can damage trust and push a child to hide things. Whatever you choose, tell the child what you do and why, and keep the door open for them to tell you about problems.

How do I stop a parent from falling for phone scams?

Agree a verification buddy, block unwanted calls, and set the rule that nobody who calls out of the blue may be paid or given a code until the parent has called you or the bank on a trusted number. Keep the tone friendly and avoid blame.

What should I do if my child shares something private they regret?

Stay calm, tell them it is not their fault, and help them report it to the app or platform. Keep evidence. If someone is threatening them, do not pay, contact the police or the child protection service in your country, and see the sextortion guide linked above.

Do shared family accounts need separate logins?

Where the service allows, yes. Separate logins let you remove one person without disturbing the others, and they show who did what. If the service forces a single login, use a password manager to share it without revealing it, and change it when anyone leaves.

Learn this in five minutes

The track "Children, Games and Online Safety" in the DefSafe app turns this guide into short lessons. You practise setting up a child's first device, building safe habits, recognising grooming and manipulation, protecting gaming accounts and responding when a child faces pressure online. Each lesson takes about five minutes on your phone.