Protecting Children Online: A Parent's Guide

Children now grow up online, and most parents worry about what they see, who they talk to and what happens if something goes wrong. This guide gives you plain-English steps you can take today: how to talk with your child, how to set up parental controls on phones, tablets, consoles and home broadband, how to spot signs that something is wrong, and exactly where to report it. It is written for parents, carers and grandparents in the UK first, with US contacts too. You do not need to be good with technology to follow it. For organisations that build services used by children, see the COPPA and Children's Privacy Guide.

Key takeaways

Talking matters more than settings. The US Federal Trade Commission (FTC) puts it simply: there is no substitute for talking with your child. Controls back up your family rules; they do not replace them.
Protect in three layers. Internet Matters suggests setting controls on your home network, on each device and inside each app or game. Each layer catches things the others miss.
Your child must feel safe telling you. If a child fears losing their phone, they may hide a problem. Promise to help first and ask questions later.
Know the warning signs. Secrecy, a new "friend" you have never met, gifts or sudden distress after using a device can all mean something is wrong.
Report quickly and keep evidence. In the UK, report sexual abuse or worrying contact to CEOP. In the US, use the NCMEC CyberTipline. If a child is in immediate danger, call 999 (UK) or 911 (US).

Start with a conversation, not a lock

The NSPCC's first piece of advice is to talk with your child about their online life, so they know they can come to you about anything that worries them. Short, regular chats work better than one big talk.

Ask, do not interrogate: "What is your favourite game at the moment? Who do you play with?" Let them show you the app. You learn a lot by watching.
Agree family rules together: when devices are used, where (shared rooms are easier for younger children), and what happens at bedtime. Internet Matters offers a free digital family agreement template you can fill in together.
Explain the "why": people online are not always who they say they are; photos can be copied and shared forever; nobody kind will ask them to keep secrets from you.
Make a "no blame" promise: tell your child that if something goes wrong, even if they broke a rule, they will not be in trouble for telling you. This is the single most protective thing many parents can do.
Revisit as they grow: Internet Matters groups its advice into four age bands (under 5, 6 to 10, 11 to 13, and 14 and over). What suits an eight-year-old will frustrate a fifteen-year-old.

Set up parental controls in three layers

The FTC says most parental controls let you limit screen time, filter content, see app and website activity, restrict who your child can contact and block purchases. Controls work best when they are set on every device your child uses, and adjusted as they get older. Menus change often, so if a setting has moved, search the vendor's help pages for its name.

Layer	Where to find it	What to switch on
Home broadband	Your internet provider's account or app (BT, Sky, Virgin Media, TalkTalk and others offer free filters)	Family or child-safe filtering for every device on your Wi-Fi
iPhone and iPad	Apple Family Sharing and Screen Time	Content & Privacy Restrictions, Communication Safety, Ask to Buy, a Screen Time passcode your child does not know, Allowed Contacts
Android phones and Chromebooks	Google Family Link	App approvals, daily limits and bedtime, Google Play mature content restrictions, location
Windows PCs and Xbox	Microsoft Family Safety	Screen time, content filters, spending limits
Apps and games	Settings inside each app (YouTube, TikTok, Instagram, Roblox, Minecraft and so on)	Private account, who can message or chat, purchase limits, supervised accounts

Set it up in about 20 minutes

Home network: log in to your broadband provider's app and turn on its family filter. This also covers visitors' devices and smart TVs.
Apple devices: on your own iPhone, set up Family Sharing and add your child. Apple's guide explains how to choose age-based settings, set Screen Time Schedules and Time Allowances, turn on Communication Safety (which warns children before they view or send nudity), and switch on Ask to Buy so you approve downloads and purchases. Set a Screen Time passcode that is different from the phone's unlock code.
Android and Chromebook: install Google Family Link. A parent can create a Google Account for a child under 13 and supervise their Android (6.0 or later) or Chromebook device. Family Link cannot supervise iPhones, iPads or Windows computers, so use the matching tool for those.
Windows and Xbox: set up Microsoft Family Safety with a child account for your child.
YouTube: Internet Matters notes that YouTube accounts for under-13s have protections on by default; for older children use a supervised account and Restricted Mode.
Social apps and games: open each app with your child and set the account to private, limit messages to friends only, and turn off location sharing. Instagram, for example, now puts users under 16 into Teen Accounts that are private by default and need a parent's permission to loosen. See the Social Media Privacy Settings Guide for platform-by-platform steps.
Test it: try to download an app or open an adult website from your child's device. If it works, a layer is missing.

What the law now requires of platforms (UK and US)

You are not on your own. Laws now put duties on the companies too.

UK Online Safety Act: Ofcom's Protection of Children Codes apply to online services likely to be used by children in the UK. Services had to complete children's risk assessments by 24 July 2025 and, from 25 July 2025, must take the Codes' safety measures (or other effective measures) to protect children.
Age checks: since 25 July 2025, Ofcom says all sites and apps that allow pornography must use strong age checks; ticking a box to say you are over 18 is no longer enough. Ofcom also expects the riskiest services to use strong age checks to keep children away from content about suicide, self-harm and eating disorders. Approved methods include facial age estimation, checks with a bank or mobile operator, digital ID wallets and photo ID matching.
Enforcement: Ofcom can fine services up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, and in serious cases ask a court to block a site in the UK.
US: the Children's Online Privacy Protection Act (COPPA), enforced by the FTC, limits how online services collect personal information from children under 13.

These rules help, but they are not perfect. NCSC notes that most platforms require users to be at least 13, yet it is easy to enter a false birth date. Setting your child's real date of birth means the platform's own child protections switch on.

Signs something is wrong

You do not need to know how offenders operate to protect your child. You need to notice changes. Any one of these can have an innocent explanation; several together are worth a calm conversation.

Secrecy: hiding the screen, switching apps quickly when you walk in, or using a second account or device you did not know about.
A new "friend": someone they talk to a lot but you have never met, often older, who seems to understand them better than anyone else.
Gifts or money: game currency, gift cards, credits or presents arriving without explanation.
Pressure to move platforms: being asked to switch from a game chat to a private messaging or video app.
Mood changes: anxiety, anger or withdrawal after being online, trouble sleeping, or not wanting to go to school.
Requests for images or secrets: any adult or stranger asking a child for photos, to keep a secret, or threatening to share something.

Bullying shows up in similar ways. Children being bullied can talk to Childline anonymously, and CEOP itself directs bullying concerns there.

What to do if it happens

Stay calm and thank your child for telling you. Reassure them it is not their fault. Do not take their device away as a punishment.
If a child is in immediate danger, call 999 (UK) or 911 (US).
Do not delete anything yet. Note usernames, profile links, dates and what was said. Do not forward, copy or save any sexual image of a child, even as evidence: that can itself be a crime. Tell the police it exists instead.
Report sexual abuse or worrying contact. In the UK, use the CEOP Safety Centre, run by the National Crime Agency, to reach a Child Protection Advisor. In the US, report to the NCMEC CyberTipline or call 1-800-THE-LOST (1-800-843-5678).
Get a nude image taken down. In the UK, the NSPCC and Childline's Report Remove tool helps young people report and remove nude images shared online. NCMEC's Take It Down service works for images or videos taken before the person turned 18: it creates a digital fingerprint (a "hash") on the device so the picture itself is never uploaded, and participating platforms use the fingerprint to find and limit copies. For images of adults, Take It Down points to StopNCII.org.
Report and block on the platform. Use the app's report button, then block the account and tighten privacy settings.
Look after your child. Childline (0800 1111) is free and confidential for anyone aged 19 or under. Parents can call the NSPCC helpline on 0808 800 5000.

Threats to share images unless a child pays or sends more are a crime. Do not pay and do not negotiate: report straight away. Similar extortion tactics are covered for adults in the Romance and Investment Scam Awareness Guide.

Protect accounts, money and privacy

Lock down your own accounts first: your Apple ID, Google or Microsoft account controls the parental settings. Use a strong password and two-step verification. See the Two-Factor Authentication for Everyone Guide.
Turn on purchase approval: Ask to Buy (Apple) or Family Link purchase approvals (Google Play) stop surprise bills. Note that Google's approval only covers purchases made through Google Play billing.
Gaming accounts: children's game accounts are often targeted for their items and currency. See the Securing Online Gaming Accounts Guide.
Think before you post about them: school uniforms, home street names and regular routines in your own photos tell strangers a lot.
AI chatbots and image tools: talk about what is safe to share with chatbots and that fake images can be made of anyone. Internet Matters publishes an AI conversation guide by age; see also the Safe Use of AI Chatbots Guide.

Where to get help

Need	UK	US
Immediate danger	999	911
Sexual abuse or worrying contact online	CEOP Safety Centre (National Crime Agency)	NCMEC CyberTipline, 1-800-843-5678
Remove a nude image of an under-18	Report Remove (NSPCC and Childline)	Take It Down (NCMEC)
Support for the child	Childline, 0800 1111	NCMEC support services
Advice for parents	NSPCC helpline 0808 800 5000, Internet Matters	FTC consumer advice
Concerns about a platform's safety duties	Ofcom	FTC (COPPA)

Common failure patterns

Controls on one device only: the phone is locked down but the old tablet, games console or a friend's device is not. Check every device, and use the broadband filter as a safety net.
Sharing the passcode: using the same code for the Screen Time passcode and the phone unlock, so your child can change the rules.
A fake birth date: setting a child's age as an adult to "get past" sign-up switches off the platform's built-in child protections.
Set and forget: controls that suited a nine-year-old are either ignored or worked around by thirteen. Review them every birthday and at the start of each school year.
Punishing the report: confiscating the phone when a child confides in you teaches them not to tell you next time.
Deleting the evidence, or saving the wrong evidence: wiping chats removes what police need, while forwarding an image of a child can be an offence. Record details and let the professionals handle images.

Practitioner checklist

Have a relaxed chat this week about which apps and games your child uses and who they talk to.
Agree and write down family rules, including the "no blame if you tell me" promise.
Turn on your broadband provider's family filter.
Set up Apple Family Sharing, Google Family Link or Microsoft Family Safety on every device your child uses.
Set a separate Screen Time or parental control passcode and turn on purchase approval.
Go through each social app and game with your child: private account, friends-only messages, location off.
Make sure every account uses your child's real date of birth.
Save the CEOP and Childline (or CyberTipline) details in your phone now.
Put a reminder in your calendar to review settings every birthday.

Protecting Children Online: A Parent’s Guide: Plain-English Steps to Stay Safe