Kids' Digital Hygiene: A Checklist for Parents
A child's safety online isn't the result of a single ban — it's built from a dozen small settings and a couple of honest conversations. We've gathered them into one checklist you can work through in an evening.
Start with your child's own account, not with bans
The first step is a separate child account — not your adult account borrowed "just for now." At Google, this is a child account managed through Family Link; at Apple, it's a member of a Family Sharing group. This kind of account gives you the legal right to manage the device and puts limits in place, from the start, on what your child sees and where their data ends up.
While you're setting up the profile, go through the privacy settings too: turn off ad personalization, restrict app access to location, microphone, and contacts, and check who can see the profile on social media. The FTC directly advises choosing parental control tools to fit your child's specific device and the boundaries your family has set, rather than turning on everything "just in case" (FTC: How To Use Parental Controls).
Screen time: agreements backed up by settings
Screen time works when a rule has been discussed with your child and is backed up by a setting on the device. On Android, open Family Link and set a daily limit, a sleep schedule (Downtime), and limits on individual apps; once the limit is reached, the device locks, leaving only calls and approved apps available (Google: Manage your child's screen time).
On iPhone and iPad, this all lives under Screen Time: a Downtime schedule, app limits, Content & Privacy Restrictions, and communication limits — you choose who your child can reach during allowed hours and during downtime (Apple: Use Screen Time to manage your child's iPhone or iPad). Start with soft limits and adjust them together with your child — that way the rules feel like an agreement, not a punishment.
Passwords and two-factor authentication
Kids' accounts get hijacked the same way adults' do — through a weak or reused password. The basic rules are simple:
- Every important account (email, gaming service, social network) has its own long, unique password.
- Passwords live in a password manager, not a notebook or notes app — it will also flag reused or leaked passwords.
- Two-factor authentication is turned on everywhere it's offered; for a child's account, an authenticator app is a better choice than SMS.
Make it a habit: a new service for your child means a unique password and a second factor right away. It takes a minute and closes off most common attacks.
Talking about strangers and phishing
No setting replaces a short, honest conversation about what's happening on the other side of the screen. The FTC advises explaining simple rules of online behavior to children and keeping the topic open, so a child comes to you with a worrying message instead of hiding it (FTC: Protecting Kids Online). Go over a few rules with your child:
- Personal details aren't for chats. Address, school, phone number, location tags, and photos from home shouldn't go to strangers.
- A link plus an "urgent prize" is a red flag. Promises of free in-game currency, skins, or gifts for clicking a link or entering a password are phishing.
- A stranger among their friends is a reason to ask you. An adult who asks to move to another messenger, keep a secret from parents, or send photos is a red flag.
- When in doubt, show a parent. Agree in advance that showing you a suspicious message will never get them in trouble.
Device and network settings: a short checklist
Go through these points on your child's phone — it takes about twenty minutes:
- A child account exists (Family Link or Family Sharing) — an adult profile isn't being reused.
- A daily limit, a sleep schedule, and limits on individual apps are set.
- Content filtering is on in the app store, YouTube, and the browser; new app installs require your approval.
- Excess app permissions (location, microphone, camera) have been revoked.
- Every important account has a unique password in a manager and 2FA turned on.
- System and app updates install automatically. There's a separate breakdown for phones in our Android security checklist.
One more thing worth covering: public networks. In a school, café, or hotel Wi-Fi, traffic is easy to intercept, so it's worth keeping a connection-encryption tool like HamikVPN turned on on your child's device: it encrypts traffic so data and logins aren't readable on an open network. It's not a replacement for parental controls — it's an extra layer of protection specifically for the connection.
Work through the checklist once, then come back to it every couple of months: apps get updated, your child's interests change, and it's worth adjusting the settings together with them.