Teaching Children About Online Safety — A Practical Guide for Parents

Controls Are Not Enough

Parts 1 and 2 of this series covered the technical controls: DNS filtering, router hardening, and platform-specific parental settings. Those controls block harmful content and limit screen time. They are necessary. They are not sufficient.

A child who understands why certain content is restricted, knows how to recognise manipulation, and feels confident telling a parent when something goes wrong is fundamentally better protected than a child who is simply fenced in by technology. The fence has gaps. The understanding does not.

This guide covers the human side of online safety: what to teach at each age, how to have productive conversations about risk, how to approach social media, and what to do when something goes wrong.

Age-Appropriate Access

There is no single right answer for when a child should have internet access, a phone, or a social media account. But there are frameworks that work for most families. The principle is graduated access: start restrictive and expand as the child demonstrates maturity and understanding.

Under 7: Supervised Access Only

Children under seven should use the internet only with an adult present. At this age, the child cannot reliably distinguish between appropriate and inappropriate content, between a real person and a stranger pretending, or between a game and an advertisement.

Practical steps:

• Devices stay in shared rooms. No screens in bedrooms.
• Use curated apps and platforms designed for young children: YouTube Kids, age-rated educational apps, BBC iPlayer Kids.
• The child does not need their own account on any platform.
• Wi-Fi scheduling (Part 1) should enforce strict hours: devices off well before bedtime.
• Introduce the idea that not everything on the internet is true and that some things are not for children. Keep it simple: "Some things on the internet are for grown-ups, just like some TV programmes."

Ages 7 to 12: Filtered Access with Oversight

Children in this range are typically using devices for school work, watching videos, and playing games. They are old enough to understand basic rules but not yet equipped to navigate complex social situations online.

Practical steps:

• The child has their own device account (Part 2) with parental controls enabled.
• DNS filtering (Part 1) is active on the home network.
• Content filtering is set to block adult content, violence, and gambling.
• No social media accounts. Most platforms require users to be at least 13 (under the Children's Online Privacy Protection Act in the US and similar regulations elsewhere). Enforce this.
• Messaging is limited to known contacts — family and school friends. No public chat rooms, no open messaging apps.
• The child understands that they should tell a parent if they see something that makes them uncomfortable, and that they will not be in trouble for doing so.
• Introduce the concept of personal information: name, address, school, and phone number are private and should not be shared online.
• Screen time limits are enforced (Part 2). Two hours of recreational screen time on school days is a common guideline; adjust based on your family's needs.

Ages 13 to 16: Graduated Freedom

Teenagers need more autonomy, and attempting to maintain the same level of restriction as for a younger child typically backfires — they find workarounds, borrow friends' devices, or simply disengage from the conversation. The goal shifts from blocking to guiding.

Practical steps:

• DNS filtering remains active on the home network but the content categories may be relaxed — malware and phishing filters stay; social media blocks come off.
• Screen time limits are negotiated rather than imposed. Agree on limits together and review them periodically.
• Social media accounts are permitted with conditions (see the social media section below).
• The child understands phishing, social engineering, and manipulation: what they look like, why they work, and what to do about them.
• Private browsing may be permitted. If you have DNS-level filtering on the network, it still applies regardless of the browser mode.
• Location sharing is a conversation, not a mandate. Some families agree on mutual sharing — the parent shares their location too. Others share only during specific activities (a walk home from school, a night out). The key is that it is agreed, not imposed.
• The child has a clear understanding of what constitutes a serious concern that must be reported to a parent: contact from strangers, requests for photographs, threats, bullying, and anything that makes them feel unsafe.

16 and Over

Older teenagers are preparing for independent adulthood. Controls at this age should focus on safety rather than restriction.

• Network-level malware and phishing filtering remains active — this protects everyone, not just teenagers.
• Device-level content filtering is typically removed or reduced to age-appropriate levels.
• Screen time limits may be removed, replaced by a conversation about balance.
• The focus shifts to digital literacy: understanding privacy settings, recognising scams, managing their online reputation, and understanding that content posted online may be permanent.
• The young person understands how to report abuse and where to find help.

Talking to Children About Online Risks

Make It a Conversation, Not a Lecture

The most effective approach to online safety is an ongoing conversation, not a one-off briefing. Children learn by asking questions and working through scenarios, not by being handed a list of rules.

Start with curiosity rather than fear. Ask what they are doing online, what games they play, what videos they watch, who they talk to. Listen. If they tell you about something concerning, respond calmly. A child who receives a panicked or angry reaction when they share something learns not to share.

What Children Need to Understand

Not everyone online is who they claim to be. People can pretend to be any age, any gender, anyone. A "friend" in a game who says they are twelve might be an adult. This is not about making children afraid — it is about making them sceptical. The same healthy scepticism they apply to a stranger in the street applies online.

Personal information is valuable. Their full name, address, school, phone number, daily routine, and photographs are information that someone with bad intentions can use. They should share this only with people they know in real life and trust.

If something feels wrong, it probably is. Children have good instincts. If a conversation feels uncomfortable, if someone asks them to keep a secret from their parents, if someone asks for photographs, if someone is pressuring them to do something — they should stop, close the app, and tell a parent. Emphasise that they will not be in trouble. The fear of punishment is the primary reason children do not report concerning interactions.

Screenshots are evidence. Teach older children to take a screenshot of any concerning message or interaction before closing it. This helps if a report needs to be made.

Nothing posted online is truly private. A photograph sent to one person can be shared with everyone. A message in a private group can be screenshotted. A social media post can be archived. This is not a reason to avoid the internet — it is a reason to think before posting.

Managing Social Media

Social media is where online safety conversations become most difficult. These platforms are designed to be compelling and children want to be where their friends are. Banning social media entirely after the age of 13 is often counterproductive — the child feels isolated from their peer group and may create accounts without telling you.

Before They Join

Before your child creates a social media account, ensure they understand:

• Privacy settings exist and need to be configured. Walk through them together on day one.
• Accounts should be set to private by default. Only accepted followers can see their posts.
• Their username should not include their full name, school, or date of birth.
• Location tagging should be disabled on all posts and photographs.
• They should not accept follow requests or friend requests from people they do not know in real life.

Platform-Specific Considerations

Instagram — set the account to private, disable location tagging, restrict who can message them (Settings > Privacy > Messages), and enable Sensitive Content Control set to Less.

TikTok — for under-16s, TikTok defaults to a private account and disables direct messaging. Enable Family Pairing by scanning a QR code from your TikTok account to link yours with your child's. This lets you control screen time, restrict content, disable direct messages, and control whether their videos appear in search.

Snapchat — the ephemeral nature of Snapchat makes it harder to monitor. Enable Family Centre to see who they are communicating with (but not the content of messages) and to restrict sensitive content. Disable Snap Map or set it to Ghost Mode so their location is not broadcast.

Discord — widely used for gaming communities, Discord has minimal built-in safety features. Enable Safe Direct Messaging (Settings > Privacy & Safety) which scans direct messages for explicit content. Keep direct messages restricted to friends only. Review which servers they have joined — public servers can expose them to unmoderated content and strangers.

WhatsApp — set profile photo visibility to Contacts Only, disable Last Seen and Read Receipts if the child prefers, and ensure they do not join group chats with unknown numbers. WhatsApp's end-to-end encryption means you cannot monitor message content remotely — trust and conversation are the primary controls here.

The Monitoring Question

Should you read your child's messages? There is no universal answer. For younger teenagers (13-14), reviewing their social media activity periodically with their knowledge is reasonable — frame it as safety, not surveillance, and do it together rather than secretly. For older teenagers (15+), the balance shifts toward trust. If you have built a relationship where your child tells you when something concerning happens, covert monitoring damages that relationship without providing much additional safety.

What you should always have is the ability to access the account if needed — know the password or have recovery access through their email. Make this clear from the start as a condition of having the account. It is not about reading every message; it is about being able to intervene if something serious happens.

Cyberbullying

Cyberbullying is the most common serious online harm that children experience. It takes forms that adults may not immediately recognise: exclusion from group chats, sharing embarrassing photographs, creating fake accounts to impersonate someone, or coordinated harassment in games.

Signs to Watch For

• Suddenly avoiding their phone or computer
• Becoming upset or withdrawn after using a device
• Reluctance to go to school
• Deleting social media accounts without explanation
• Changes in sleep patterns or appetite

What to Do

• Listen without judgement. Do not take the device away as a first response — this punishes the victim.
• Document everything. Take screenshots of messages, posts, and profiles involved.
• Block the person or people involved on every platform.
• Report the behaviour to the platform. Every major platform has reporting mechanisms for harassment and bullying.
• If the bullying involves someone at the child's school, report it to the school.
• If the bullying involves threats of violence, sexual content, or criminal behaviour, report it to the police and to the National Crime Agency's CEOP (Child Exploitation and Online Protection) command at ceop.police.uk.

If Your Child Is Doing the Bullying

This is harder to address but equally important. If activity reports or a school notification reveals that your child is participating in bullying behaviour:

• Address it directly. Do not minimise it as "just joking" or "everyone does it."
• Discuss the impact on the other person. Children and teenagers often struggle to understand the effect of their behaviour when they cannot see the other person's reaction.
• Set consequences. Temporary loss of the platform where the bullying occurred is proportionate.
• Monitor the situation to ensure it stops.

Grooming and Contact from Strangers

Online grooming is when an adult builds a relationship with a child with the intention of exploitation. It typically follows a pattern: making contact through a game, social media, or chat platform, building trust over days or weeks, isolating the child from parents, and escalating the relationship.

Warning Signs

• A new "friend" who is significantly older
• Someone who gives the child excessive compliments or gifts (in-game items, money)
• Someone who asks the child to move the conversation to a more private platform
• Someone who asks the child to keep the relationship secret from parents
• Requests for photographs, especially if they escalate

What to Teach Your Child

• An adult who asks a child to keep secrets from their parents is not safe.
• An adult who asks for photographs is not safe, regardless of the reason given.
• It is always acceptable to stop talking to someone, block them, and tell a parent.
• They will not be in trouble for reporting this, no matter what happened in the conversation.

What to Do

• Do not confront the individual. Do not delete the messages.
• Report to CEOP at ceop.police.uk. CEOP handles reports of adults behaving inappropriately toward children online.
• Report to the platform.
• Preserve all evidence.

What to Do When Something Goes Wrong

Despite every control and conversation, your child may encounter harmful content, be contacted by someone with bad intentions, or make a mistake they regret. How you respond determines whether they come to you next time.

Responding to a Disclosure

When your child tells you something concerning:

• Stay calm. Your reaction matters more than the content. If you panic, shout, or blame the child, you close the door to future disclosures.
• Thank them for telling you. This takes courage. Acknowledge that.
• Ask questions gently. Understand what happened, when, and who was involved.
• Do not remove their device unless there is an immediate safety concern. Removing the device punishes the child for being honest.
• Take action: block the person, report to the platform, report to CEOP if appropriate, inform the school if relevant.
• Follow up in the days that follow. Check how they are feeling. Reassure them that they did the right thing.

Useful Contacts (UK)

• CEOP — ceop.police.uk — report adults behaving inappropriately toward children online
• Childline — 0800 1111 — free, confidential helpline for children and young people
• Internet Watch Foundation — iwf.org.uk — report criminal content (child sexual abuse imagery)
• NSPCC — 0808 800 5000 — advice and support for adults concerned about a child
• UK Safer Internet Centre — saferinternet.org.uk — resources, advice, and a helpline for professionals

Building a Healthy Relationship with Technology

The goal of all of this — the network controls, the device settings, the conversations — is not to make the internet frightening or forbidden. The internet is a remarkable resource. Children who learn to use it safely and critically are better prepared for a world where digital literacy is as fundamental as reading.

The controls you put in place are scaffolding, not walls. As your child matures, the scaffolding comes down piece by piece. What remains is the judgement, the scepticism, and the confidence to ask for help — and those are built through conversation, not configuration.

Summary

Technical controls protect children from stumbling into harmful content; education protects them from the harms that seek them out. Start with age-appropriate access: supervised use for young children, filtered access with oversight for primary school age, graduated freedom for teenagers. Talk to your children about personal information, stranger awareness, and the permanence of online content. Configure social media accounts together with privacy settings enabled from day one. Understand the signs of cyberbullying and grooming. When something goes wrong, respond calmly, document the evidence, and report through the appropriate channels. The technical controls from Parts 1 and 2 and the conversations in this guide work together — neither replaces the other.