What you are actually trying to build

Most online-safety advice starts from the wrong picture. It imagines a wall, a child on the safe side of it, and your job as building the wall higher. That picture feels right and it fails quietly, because a child on the wrong side of a wall you built does not call for help. They already know what you will say.

So start somewhere else. The thing you are building is a child who tells you. Everything else — the filters, the screen-time limits, the router settings — is there to cut down the accidents that happen before they are old enough to handle them, and to buy you a few more years of runway. That is genuinely valuable. It is not the same as safety.

There is research on this. Researchers at the University of Central Florida analysed 736 reviews of parental-control apps written by children and teenagers themselves, alongside a survey of 215 US parent-and-teen pairs, and presented the work at the Association for Computing Machinery’s CHI conference in 2018. Around 79% of the young reviewers gave those apps two stars or fewer, and their complaints were consistent: overly restrictive, privacy-invading, and a way for parents to avoid parenting. What the teenagers said they wanted instead was that their parents would talk to them.

The measure of a good setup is not what your child cannot reach. It is whether they walk into the kitchen and tell you.

None of which is an argument for doing nothing. A nine-year-old should not be able to stumble into a pornography site because an advert took them somewhere odd. That is an accident, and accidents are exactly what technology is good at preventing. Keep the controls. Change what you expect from them.

Seven is not fifteen

A seven-year-old and a fifteen-year-old face almost opposite problems. The same settings applied to both will be useless for one and insulting to the other.

Roughly six to nine. The risk is accidental exposure, not predators. Autoplay carries them somewhere they did not choose, an advert opens a browser, a free game asks for a card. Almost everything worth doing here is a hard boundary set once: a locked-down account, no open browser, no payments, and the device used in a room where other people are.

Roughly ten to thirteen. This is where messaging arrives, and with it the first real chance of contact from someone who is not a classmate. Children lie about their age to get past sign-up screens, and every platform knows it. Your controls should shift from “what can they see” to “who can reach them”.

Roughly fourteen to seventeen. Your job changes from gatekeeper to consultant, whether you like the timing or not. A teenager with a phone, mobile data and a friend’s WiFi has more routes around your setup than you have hours to close. What survives at this age is what you both agreed to out loud, plus a small number of non-negotiables you can actually explain.

The controls worth a Saturday morning

Two layers pay for themselves. Do both once, properly, then leave them alone.

Layer one: the device

On an iPhone or iPad, the whole system hangs off a Child Account inside Family Sharing. Once that exists, Screen Time gives you app limits, downtime, content ratings and a payment approval step. Apple’s Communication Safety feature also switches on by default for child accounts, blurring nudity in photos and videos before the child sees them. The detail worth knowing sits in Apple’s own support documentation: the analysis happens on the device, and Apple states it does not receive any indication that nudity was detected and does not get access to the photos or videos. Apple previewed more of these controls in June 2026 — an Ask to Browse approval step for new websites, and time allowances by app category — arriving in September.

On Android and Chromebooks, Google Family Link does the same job: app approval before anything installs, daily and per-app time limits, School Time and Downtime schedules, SafeSearch and content filters across Chrome, Play, YouTube and Search, plus location. Set it up from your phone, on their device, with them in the room.

Layer two: the network

Device controls miss everything that is not a phone — the smart TV, the old tablet in the lounge, a cousin’s laptop on your WiFi. A DNS filter on the router covers all of it in about ten minutes and costs nothing.

Cloudflare publishes a free family resolver. Log into your router (usually 192.168.0.1 or 192.168.1.1 in a browser), find the DNS settings, and replace the addresses with 1.1.1.3 and 1.0.0.3, which Cloudflare’s own documentation describes as blocking malware and adult content. Use 1.1.1.2 and 1.0.0.2 for malware blocking only. Reboot the router, and every device on the house WiFi is filtered, including the ones with no parental controls of their own.

Be honest about the limit: this does nothing over mobile data and nothing on a friend’s network. It is a floor, not a ceiling.

The settings that do the most work

Some of this has been done for you. Instagram now places under-18s into Teen Accounts by default: the account is private, only people they already follow can message them, sensitive content sits at the strictest setting, and under-16s need a parent’s permission to loosen any of it. Roblox went further and now requires an age check before a user can reach chat at all, sorting players into six age bands so adults cannot start conversations with much younger children.

Beyond that, three settings buy more safety per minute of argument than anything else on this page:

1. Payments off, or set to ask. Removes the most common household disaster, and it is not even a safety setting.
2. Messages from people they do not follow: off. On every platform they use. This is the one that closes the door on cold contact.
3. Devices charge outside bedrooms overnight. Not software at all, and the highest-yield rule in this guide. Most of what goes wrong, goes wrong after midnight.

What is theatre, and what it costs you

Some of the most heavily marketed tools are close to useless, and a few are expensive in the currency that matters.

Full message-reading on a teenager. A fourteen-year-old who does not want to be read will use the browser instead of the app, or a second account, or a friend’s phone, and you end up knowing less than before. You have not bought oversight. You have bought a more sophisticated opponent.

Anything installed secretly. Here is a clean test: if you would not be willing to tell your child it is there, do not install it. Secret monitoring gets discovered, roughly always, and the day it is discovered is the day disclosure stops. It also sits on the wrong side of a principle worth holding — this is about children and the adults responsible for them, and none of it should ever be pointed at another adult.

Screenshot-everything tools. They produce an enormous pile of material and very little signal, and they leave you holding a detailed file of a child’s private life. That file is not nothing under South African law: POPIA defines a child as anyone under 18 who is not legally competent to act without a competent person, and treats their personal information as a category needing extra care. You are that competent person, and the custodian of the file.

Age gates. A box asking “are you over 18?” stops nobody. Treat any self-declared age screen as decoration.

Location sharing sits somewhere different. It is fine, and often useful, on one condition: it is mutual and everybody knows. If you can see them and they can see you, it is a family map. If only one direction works, it is surveillance, and it will be read that way.

The conversation when you hand over the phone

The day the phone changes hands is the one moment you have their full attention. Do not spend it on a lecture about screen time. Spend it setting the terms of disclosure, because that is the part you cannot install later. Say this out loud, in the room, before the device is unlocked.

This phone is yours to use. Three things come with it.

1. It sleeps in the kitchen. So does mine.
2. If someone you don't know messages you, show me. You
   will not be in trouble and I will not take the phone.
3. If you ever see something that scares you, tell me
   that day. Same deal - no trouble, nothing taken away.

We will sit down again in six months and change the
rules if they are working.

That last line is the one parents skip, and it does more work than the other three combined. A rule with a review date is a rule a teenager can live inside, because there is a legitimate route to more freedom. A rule with no review date is a wall, and walls get climbed rather than negotiated. Put the date in your calendar the same evening, and keep it.

Then loosen controls on that schedule and say why: “You handled the group-chat thing well, so the browser filter comes off this term.” Controls that fall away through your own inattention teach the opposite — that wearing you down works and talking to you does not.

The first time they show you something bad

At some point a child will bring you a screenshot, or a message, or a story that lands like a stone. What you do in the next ninety seconds decides whether there is ever a second time.

The reaction that ends disclosure is the honest one: panic, then confiscation. From the inside it feels like protection. From where they are standing, they told the truth and the phone went into a drawer, and that lesson gets filed permanently. So have the words ready in advance, because you will not compose them in the moment.

Thank you for telling me.

You are not in trouble. You did the right thing.

Let's look at it together and work out what to do next.

Then actually do that. Sit next to them, look at the thing, and make the next decision jointly — block, report, screenshot, delete, or nothing at all. Being included in the decision is most of what makes a child willing to come back a second time.

The no-consequences agreement only means something if it survives a night you did not want it to. If what they tell you makes you furious, the promise still holds. Address the underlying thing later, on a different day, as its own conversation. What you cannot do is punish the telling, because the telling is the whole system.

Grooming and sextortion, without the panic

Both are rarer than the volume of writing about them suggests, and both are real. Describe them plainly, once, at a level that fits the child’s age — a child who recognises the pattern early tends to break contact on their own.

What grooming looks like from the outside

The pattern is consistent enough to name. Unusual attention and flattery from someone older. A push towards secrecy, framed as a special bond. A move off the platform where they met — from a game’s chat to WhatsApp, from WhatsApp to something that deletes itself. Gifts: airtime, data, Robux, a voucher. Then testing, in small steps, whether the child will keep something from their parents.

The government publication Vuk’uzenzele lists the signs it advises South African parents to watch for: excessive secrecy about online activity, an older boyfriend or girlfriend, meeting people in unusual places, sudden new possessions, and access to alcohol or drugs. Grooming a child is a serious offence in its own right under the Criminal Law (Sexual Offences and Related Matters) Amendment Act 32 of 2007.

Sextortion, and why the child is not the guilty party

The FBI describes the financially motivated version in useful detail, because the pattern barely varies. An account posing as a peer — typically new, few followers, sometimes copying someone the child knows — makes contact and builds rapport fast. An image is requested. The moment it arrives the tone changes, money is demanded, and the threat is to send the image to family and friends. Victims are often boys in their mid-teens, which surprises most parents.

The FBI’s advice is short and worth memorising: report the account through the platform’s safety feature, block the person, save the profile and messages because they help law enforcement, and get help from a trusted adult rather than paying or sending anything more. Cooperating rarely stops the blackmail. The sentence a child needs first is the one they will not believe:

This is not your fault, and it is not yours to fix alone.

We are not paying them. We will block them, keep the
messages, and get help.

If an image of someone under 18 is already circulating, the National Center for Missing & Exploited Children runs a free service called Take It Down at takeitdown.ncmec.org. It generates a digital fingerprint, or hash, of the image on the device itself — the picture is never uploaded — and sends only that fingerprint to participating platforms so they can find and remove matching copies. StopNCII does the equivalent job for people already over 18.

Under South African law, sharing an intimate image without consent is a crime. Section 16 of the Cybercrimes Act 19 of 2020 covers the unlawful disclosure of a data message containing an intimate image, and section 19 sets the penalty at a fine or imprisonment of up to three years, or both. A child in this situation is the victim of a crime, and it is worth saying that to them in those words.

Reporting in South Africa: the actual routes

Knowing where to phone before you need to phone is worth ten filters. The numbers below come from the government’s own published helpline list and from the Film and Publication Board’s own site.

Two things about the FPB route. Its child protection team describes offering telephonic psychosocial support alongside the report, so the call is not only paperwork. And the FPB belongs to INHOPE, the international network of hotlines — which is how a report made from a kitchen in Bloemfontein reaches police in whatever country the content is hosted.

Childline South Africa runs online counselling on weekdays as well as the 24-hour line, with current hours on childlinesa.org.za. SAPS has specialised Family Violence, Child Protection and Sexual Offences units for exactly these cases, and its own guidance is clear that a report cannot be turned away because time has passed or because you are at the wrong station.

Report on the platform too, every time. It is slow and it feels pointless, and it is how accounts eventually come down.

When it is no longer your job

Bring in the school — the counsellor, or whoever runs Life Orientation — when other pupils are involved, because a cruel group chat is a school-community problem and schools have tools you do not. Bring in SAPS when a crime has been committed, including the sharing of an intimate image of a minor. Bring in a therapist when a child stops eating or sleeping, withdraws sharply, or says anything about not wanting to be here. We write about technology and we are not clinicians: that last one is a same-day call to a professional, not a settings change. Childline takes calls from parents too.