Child online safety: a practical guide for parents and carers

You do not have to switch off the wi-fi or read every message to reduce the risks your child meets online. Ofcom's 2026 research points to a small number of recurring problems, and most of them respond to two things: a handful of settings you configure once, and a regular, low-key conversation.

What the evidence actually says about the risks

It helps to sort online risk into three groups, because each one needs a different response.

• Contact — someone trying to build a relationship with your child, whether that is an adult they do not know or unkindness from peers.
• Content — material that is not appropriate for their age: violence, sexual content, misinformation, gambling sites.
• Conduct — what your child does themselves: sharing personal data, spending money without asking, or losing track of time.

Most parents worry first about strangers. The Ofcom data suggests the more common experience is closer to home. Almost a quarter (23%) of children aged 8 to 17 who answered said someone had been nasty or hurtful towards them personally in the previous 12 months. Among that group, 47% said it happened through social media, 43% face-to-face, 41% through messaging apps and 38% in online games.

Ofcom's separate safety tracker found that 62% of 11 to 17 year-olds recalled seeing bullying content in a four-week period, up significantly from 58% in the previous wave. Parents' own concerns line up reasonably well with this: 69% worry about age-inappropriate content, 66% about their child knowing what is real or fake online, and 64% about their child being bullied online.

The practical conclusion is not that strangers do not matter. It is that peer behaviour is the thing your child is most likely to run into, so the plan needs to cover it.

Agree house rules that are specific, not vague

"Be careful online" gives a child nothing to act on. Rules work better when they read like an agreement you both signed rather than a list of instructions.

• Screens in shared spaces — the computer in the living room, phones charging overnight outside the bedroom.
• An agreed amount of time — for example, an hour and a half after school and two hours at the weekend.
• Private accounts you can see — your child's social accounts are set to private, and you are one of the followers.
• Unknown contact means no reply — if someone gets in touch and your child does not know who they are, they tell you first.
• Ask before sharing photos or details — before sending a picture or giving out their name and school, they check with you.

Work through the rules together rather than announcing them. Asking "what do you think of this one?" takes a minute, and a child who understands the reason behind a rule is less inclined to look for a way around it.

Set up parental controls — and know what they miss

Filters and limits are worth having. They are also partial, and it is better to know where the gaps are than to assume they are covered.

On your child's devices

• iPhone and iPad — Screen Time: app limits, restrictions on adult content, and no installing apps without your approval.
• Android — Google Family Link: comparable controls, managed from your own phone.
• Windows — a child account under Microsoft Family Safety: activity reporting, time limits and content filtering.

On your broadband and mobile network

Every major UK broadband provider includes network-level filtering at no extra cost — BT Parental Controls, Sky Broadband Shield, Virgin Media Web Safe, TalkTalk HomeSafe and the rest. These apply to every device on your home wi-fi without installing anything. Internet Matters publishes step-by-step guides for each provider, and it takes a few minutes per household.

The important limitation, which Internet Matters flags directly: broadband filters stop working the moment a device leaves your wi-fi and uses mobile data or someone else's network. Controls also do nothing about unkindness from classmates, do not catch everything inside TikTok or Instagram, and are not a substitute for your child being willing to tell you what they saw.

What platforms are now required to do

Since 25 July 2025, services likely to be accessed by children have had duties under the Online Safety Act 2023, regulated by Ofcom. According to GOV.UK, platforms must use highly effective age assurance to keep children away from pornography and content encouraging suicide, self-harm or eating disorders, must take steps on other harmful material including bullying and hateful content, and must give parents and children clear, accessible ways to report problems.

Separately, the ICO's Children's Code sets data-protection standards under UK GDPR and the Data Protection Act 2018. Among its fifteen standards, privacy settings should be high by default for children and geolocation should be switched off by default. That makes it worth opening your child's accounts and checking what the defaults actually are on their device, since settings can drift after updates or be changed.

For you as a parent, the useful part is simple: the in-app report button is now a regulated route, not a suggestion box. Use it.

How to respond when something goes wrong

If your child sees something disturbing or receives a message that worries them, the outcome you want is that they tell you. That depends on what you did before it happened.

1. Thank them first — "I'm glad you told me" matters more in that moment than getting the details straight away.
2. Keep your reaction level — visible panic teaches a child that next time it is easier to say nothing.
3. Act together — block the account, report the content in the app, and decide the next step as a pair.

Beyond the platform's own report button, there are established UK routes. Report Remove, run by Childline and the Internet Watch Foundation, helps under-18s get a sexual image of themselves taken down. If you are worried about how an adult is communicating with a child, that goes to CEOP. The NSPCC keeps a single page explaining which service handles what.

Once a month, ask something deliberately casual: "seen anything online lately that was weird or annoying?" It costs nothing and keeps the door open.

Checklist: before your child gets their first phone

This takes about half an hour once, then a review each year.

• The child's Google or Apple account is set up with their real date of birth, so age-based protections apply.
• Screen Time or Family Link is switched on and linked to your device.
• App limits are set for social apps — 45 minutes a day, for instance.
• In-app purchases require your password.
• Social accounts are set to private, and location sharing is off.
• Your broadband provider's free parental controls are switched on.
• There is an agreed time the phone goes on charge for the night — 9pm, say.
• You have had the conversation about the rules, and your child has agreed to them.