_Part 6 of 18 in the Digital privacy for board directors series. The third of five posts focused on children._

This is the post in the series I have rewritten the most times. The subject is the one most parents avoid until it becomes unavoidable, and the one where the published guidance ages most poorly. I am writing it for the parent of a child between, roughly, ten and sixteen — the years when social media first becomes a real conversation and when the parent's reasonable role is most contested.

I will be specific where I can be. I will not pretend to certainty I do not have.

What we are actually talking about

The phrase social media in 2023 means a much wider range of services than it did five years ago, and the things that previous generations of parents had to think about (Facebook, Twitter) are largely not the things current parents have to think about. The current shortlist, for British children between ten and sixteen:

Each has its own privacy posture, its own safety controls, and its own pattern of use. A blanket policy for social media is not useful. A platform-specific position usually is.

The platforms' own restrictions

Each major platform formally requires users to be 13 or older. Several offer special protections for under-16s or under-18s. The reality is that a meaningful proportion of UK 8- to 12-year-olds use these platforms with their parents' knowledge, often with a slightly fictionalised age. This is not a moral judgment. It is the operating reality.

The ICO's Children's Code — formally the Age Appropriate Design Code — has been in force since 2021 and requires online services likely to be used by children to provide high-privacy defaults, minimise data collection, and avoid using dark patterns against children. Compliance is patchy. The principle is right and the regulator is engaged. I expect enforcement to harden over the next two to three years.

The parent's reasonable role

There is no single correct posture. The right one for your family depends on your child's age, maturity, peer group, and the family conversation you have built. What follows is the framework I use with families I advise.

Stage one (typically pre-teen). No personal social media accounts. Shared family accounts are fine — a YouTube account the parent set up, a family Pinterest, a shared Spotify. Messaging is via the parent's phone or a kids messenger app where messages are visible.

Stage two (typically 11–13). The first messaging platform, usually WhatsApp on a phone the child uses with the parent's awareness. No public-facing accounts. School-class group chats are part of life by this age. The parent's role is to be the calm adult who can be consulted when something goes wrong, not the surveillant who reads every message.

Stage three (typically 13–16). First personal social media accounts, usually with private settings. The parent's role is to make sure the privacy and safety settings are set up correctly at the start, that the child knows how to block and report, and that the child knows the parent is available for the difficult conversations. The parent is not the auditor of daily activity; that is a fight you will lose.

Stage four (typically 15+). Increasing autonomy. The conversations shift from what platforms are you on to how are you handling this thing that happened. The parent's job is to be useful when the child comes to them and to have built enough trust that the child does come to them.

These stages are approximate and vary by child. The principle holds: the parent's role moves from controlling to advising over the course of a few years. The transition is where most family conflict happens.

The conversations worth having

Three conversations that, in my experience, work.

The screenshot conversation. Whatever you send anywhere, someone can screenshot. Snapchat's ephemeral claim is a marketing claim, not a technical one. Anything you would not want a third party to see in five years, do not send.

The DM-from-stranger conversation. The platforms will deliver direct messages from people the child does not know. Several of those messages will be from people whose intentions are not good. The child needs to know that blocking and reporting is normal, that they will not be in trouble for showing the parent, and that no, the stranger is not their friend, no matter how it has been framed.

The image-sharing conversation. This is the one most parents flinch from. The reality, well-documented by the NSPCC and others, is that a meaningful proportion of British teenagers exchange intimate images of themselves and others. The conversation parents need to have is what to do if it happens to you and what to do if a friend's image is being shared. The Take It Down service and Report Remove from Childline are the practical tools available to under-18s to request removal of intimate images. Their existence should be known.

The privacy settings to set up at account creation

For each platform, fifteen minutes of joint configuration at account creation. The settings that matter:

What you do not need to do

Spy on your child's messages. Install monitoring software without their knowledge. Demand they show you their phone every evening. These tactics will, in my professional and personal experience, damage trust more than they protect the child. The protection comes from the relationship, not the surveillance.

There are situations where deeper monitoring is appropriate — significant safeguarding concerns, established patterns of risk-taking, prior incidents. These are not the default. The default is the relationship.

What this month looks like

One conversation, fifteen minutes long, with each child you have who is in or near social media age. Plus, for each child already on a platform, fifteen minutes of joint privacy-settings configuration. The conversations matter more than the settings.

In four weeks: the fourth children-focused post — gaming, voice chat, and the online communities that look least like social media but function most like it.