How do I keep my kids safe online without spying on them?

Quick answer

The honest answer in 2026 is that technical controls (Apple Screen Time, Google Family Link, content filters on the router) handle the easy 20%, but the 80% that matters — kids reporting strange messages to you, recognising scams, knowing what to do if something goes wrong — comes from a continuing conversation, not an app.

What it's NOT

Child safety online is NOT a single setting you toggle once — it changes as children grow and as platforms change. It is NOT primarily about porn filters; the realistic harms are scams targeting teens, contact from strangers in games, body-image pressure on social media, sextortion, and over-sharing personal info. And it is NOT something you outsource entirely to school or to platforms — both help, but the legal and emotional first line is parents.

More context

Child safety online is the bundle of habits, conversations, and tooling that helps a family raise children who can use the internet without coming to serious harm — and who know what to do when something goes wrong. The honest picture in 2026: the technical part is the easy 20%, and the cultural part — what gets talked about at the kitchen table — is the 80% that matters.

The realistic threat picture for children and teens today, in order of prevalence:

  1. Stranger contact in games and DMs. A friendly adult in a Roblox / Fortnite / Discord chat, a follow request on Instagram, a Snap from an unknown handle. Most are harmless; the ones that are not progress quickly to “let’s move to WhatsApp / Telegram”, to requests for photos, and sometimes to sextortion or in-person meetings.
  2. Scams targeted at teens. Gift-card scams, fake “Robux free” offers, fake creator-program DMs, fake “you’ve been hacked, click here” notifications inside games.
  3. Sextortion. Sometimes called “financial sextortion”: a stranger pretends to be a peer, asks for intimate photos, then threatens to share with friends and family unless paid. This has exploded since 2023, especially among teenage boys. See sextortion.
  4. Body image, mental health, comparison pressure. Social-media platforms optimised for engagement reliably amplify content that drives this. Less acute per incident than the items above, more chronic across years.
  5. Inappropriate content reached deliberately or accidentally. Pornography, graphic violence, eating-disorder communities, conspiracy content. Porn filters address part of this; algorithmic recommendation drives more of it than direct searching.
  6. Identity exposure. Real names, schools, addresses, holiday plans, photos in uniform — posted publicly because the platform encouraged it.

What technical controls actually do well:

  • Apple Screen Time / Google Family Link. Time limits, content restrictions, purchase approvals, location sharing, downtime windows. Best for ages 5-12; partial for teens.
  • Router-level filtering (see router security, guest-network design). Some routers and DNS services (CleanBrowsing, NextDNS, OpenDNS Family Shield) block adult content network-wide.
  • Platform-specific kids modes. YouTube Kids, age-gated Discord servers, “Take a Break” reminders on TikTok and Instagram. Useful as default settings, easily bypassed by motivated teens.
  • Two-factor authentication on the child’s main accounts, especially email and the platform that resets everything else. See 2FA.

What the conversation has to cover, regardless of age:

  • “Tell me — I will not be angry.” Children who fear punishment do not report. The single most important habit a family can build is making it safe to come and say “something weird happened”.
  • “Adults asking children to keep secrets from parents are wrong.” No special club, no game guild, no online friend has a legitimate reason to ask a child to hide a conversation from their parents.
  • “Once you send a photo, it is no longer yours.” Photographs of bodies, of school uniforms, of homes — they travel further and longer than children expect.
  • “The internet is not anonymous.” Strangers online are strangers; the platform knows who you are; what you say leaves a record.
  • “Money requests are always a red flag.” Real friends — online or offline — do not need gift cards from a 13-year-old.

For different ages, the practical balance shifts:

  • Under 8. Heavy technical controls, supervised use, no DMs, family computer in shared space.
  • 8-12. Tighter platform settings, agreed time budgets, regular check-ins, the device returns to a family location at night, no private DMs with strangers, parents have the password.
  • 13-16. Loosen technical controls, tighten conversation. Agreed device-free times. Talk about specific scams, sextortion, body-image pressures. Parent retains the right to look but not routinely; the deal is openness in exchange for autonomy.
  • 16+. Mostly trust and openness. By this age, technical controls bought against a determined teen are mostly theatre — your defence is that they tell you when something is wrong.

Resources to save before you need them: in France, e-Enfance / 3018 (free helpline, chat, and email, 9am-11pm), Pharos for reporting criminal content, NetEcoute for general support. In the UK: NSPCC, CEOP, Internet Matters. EU-wide: Better Internet for Kids. US: NCMEC and Take It Down (specifically for nude images of under-18s, runs takedown across major platforms). For the legal frame, the Council of Europe maintains a current overview.

The honest closing: technical controls are useful and worth setting up, but they are the frame for the conversation, not a substitute. The teens and children who navigate the internet best are the ones who can talk to their parents about it. That is the part Engarde — distinct from other vendors sharing the Engarde name — was built around: behaviour, not blocking.

People also ask

What are the realistic online threats to children in 2026? +

In order of how often they actually cause harm: (1) Contact from strangers — in games, on Snap/Insta/TikTok, in Discord servers. (2) Scams targeted at teens — gift-card scams, fake free-skin offers in games, fake brand-ambassador DMs. (3) Sextortion — see [sextortion](/en/library/everyday/sextortion/); this has exploded among teen boys since 2023. (4) Body-image and mental-health pressure on social platforms. (5) Inappropriate content reached accidentally or deliberately. Porn filters address the last one, which is rarely the most damaging.

Apple Screen Time vs Google Family Link — what do they actually do? +

Both let a parent see and set limits on a child's device from their own phone: time limits per app and per day, content restrictions (age-rated apps, web filtering, explicit-music blocking), purchase approvals, location sharing, and 'Downtime' / school-hours blocks. Apple Screen Time is built into iOS and macOS; Google Family Link covers Android and Chromebook. Both are free, both have been refined considerably since 2020, both have gaps that older children figure out (factory-reset workarounds, second devices, web browsers Microsoft Edge instead of Safari). Useful for younger children, partial coverage for teens, and not a substitute for trust.

Should I read my kid's messages? +

Reasonable parents disagree on this — and it depends on the age. For young children (under 10-ish), most cybersecurity authorities (the UK's NCSC, France's e-Enfance, US CommonSenseMedia) suggest broad oversight with the child's knowledge. For teens, secret surveillance reliably damages trust without preventing the harms you actually fear: a teen who needs to tell you something will tell you if they trust you, and won't if they don't. A better pattern: agreed regular check-ins, the device returns to a shared family location at night, and a clearly stated rule that the parent has 'the right but not the routine' to look — and only with the teen present.

What should I tell my child to do if a stranger contacts them online? +

Three things, repeated until they stick. (1) 'Adults asking children not to tell parents are wrong, every time. There is no special-club secret that should keep us out of the loop.' (2) 'Never send a photo of yourself, your room, or your school uniform to someone you have not met in person. Once you send, it is theirs forever.' (3) 'Tell me, and I will not be angry. I will be glad you told me. The thing I will be angry at is the adult who tried to trick you, not you.' The third one is the most important — children who fear punishment do not report.

Where can I learn more or report problems specifically about children? +

France: [e-Enfance / 3018](https://www.e-enfance.org/) (free national helpline, 9am-11pm, also chat), [Pharos](https://www.internet-signalement.gouv.fr) for criminal content. UK: the [NSPCC](https://www.nspcc.org.uk/), [CEOP](https://www.ceopeducation.co.uk/), [Internet Matters](https://www.internetmatters.org/). EU-wide: [Safer Internet helplines](https://www.betterinternetforkids.eu/). US: [NCMEC](https://www.missingkids.org/), [Take It Down](https://takeitdown.ncmec.org/) (specifically for nude images of under-18s). Save these now — when you need them, you will not want to be searching.

Also explained

What is sextortion, and what do I do if it happens to me or my child?

Sextortion is when someone — usually a stranger online — gets or fakes an intimate image of you, then threatens to share it with your family, friends, or employer unless you pay or send more; the right response is do not pay, do not delete the conversation, take screenshots, report to the platform and to a national helpline immediately, and tell someone you trust — police and dedicated services can act fast if you act fast.

How do I tell a scam call or text from a real one?

If a call or message creates urgency, asks for a code or password, requests a transfer or gift cards, or threatens you with arrest, fines or account closure, treat it as a scam regardless of who it claims to be — and call the real institution back on a number you find yourself, never on the number the caller gave you.

How do I secure my home Wi-Fi router?

Five steps cover almost all real risk: change the default admin password on the router (not just the Wi-Fi password), use WPA3 or WPA2 with a strong passphrase, turn off WPS and remote admin from the internet, keep the router firmware updated, and set up a separate guest Wi-Fi for visitors and smart-home devices.
← Back to everyday cybersecurity