15 Online Safety Questions Every Parent Should Be Able to Answer

Online safety has gotten more complicated, mostly because the details matter. A private account is not invisible, HTTPS does not mean a website is trustworthy, and a 13-plus age rule does not mean every person on a platform has been independently verified. Platforms have added more teen protections, parental controls, and age checks in recent years, but parents still need to know what those tools actually do and where their limits are.

These 15 questions cover some of the online-safety details that are easy to miss. You do not need to be a cybersecurity expert to get them right. You just need to know where the weak spots are and which settings are worth checking.

HTTPS means the connection between your browser and the website is encrypted, which helps prevent someone on the network from casually reading or changing the information moving between the two. It also lets the browser verify the certificate presented for the site you connected to. What HTTPS does not tell you is whether the person or business behind that site is trustworthy. A phishing site can use HTTPS too. Before entering a password, payment information, or other sensitive data, check the domain name itself and make sure you are on the site you intended to visit.

Child identity theft can be difficult to spot because most minors are not regularly applying for credit. Warning signs can include collection notices for accounts you never opened, an IRS notice involving your child, problems with government benefits, or a credit history that appears when your child eventually applies for a loan or other account.

The Federal Trade Commission says parents or guardians can request a free credit freeze for a child under 16 at Equifax, Experian, and TransUnion. Minors who are 16 or 17 can request a freeze themselves. The FTC also notes that most children under 18 normally will not have a credit report at all, so parents can ask the bureaus to conduct a manual search if they suspect misuse.

The Children’s Online Privacy Protection Act, or COPPA, is a privacy law, not a general internet-safety law. Its rules apply to websites and online services directed to children under 13, as well as general-audience services that have actual knowledge they are collecting personal information from a child under 13. Covered services generally must give parents notice and obtain verifiable parental consent before collecting, using, or disclosing a child’s personal information, subject to limited exceptions.

The FTC strengthened the COPPA Rule in 2025, including tighter limits on data retention and a separate parental opt-in before covered operators can disclose children’s information to third parties for targeted advertising or certain other purposes. COPPA does not guarantee that a child will never see inappropriate content, and it does not create a universal rule that every online service must simply ban everyone under 13.

A phone can embed location coordinates in a photo when the camera has permission to use location services. Whether that location data reaches another person depends on the device, the app, and how the picture is shared. Apple lets users remove location information before sharing, while Google Photos gives users controls over whether location details are included in shared albums, links, and conversations.

Metadata is only part of the problem. A photo can reveal a school name, street sign, house number, sports uniform, or recognizable landmark even after location data is removed. Before posting pictures of children, it is worth checking both the photo’s location information and what is visible in the frame.

Two-factor or multifactor authentication adds another step beyond a password, such as an authenticator app, security key, biometric check, or one-time code. That matters because a stolen password alone may no longer be enough to get into the account. The Cybersecurity and Infrastructure Security Agency recommends using MFA on important accounts, including email, social media, financial services, and gaming accounts.

Not every second factor is equally strong. CISA recommends phishing-resistant options such as security keys when they are available, followed by authenticator-app methods. Texted or emailed codes are still better than relying on a password alone, but they provide weaker protection. For a family, the priorities should include the email accounts that can reset everything else, followed by social media, gaming, school, and other accounts containing personal information.

A private account limits who can see certain content, but the exact rules depend on the platform. On TikTok, for example, a private account restricts posts and several profile details to approved followers. Snapchat also uses restrictive privacy defaults for teens. Those settings can reduce exposure, but they do not make content impossible to copy or share.

Anyone who is allowed to see a post may still be able to screenshot it, screen-record it, photograph the screen, or repeat the information somewhere else. The platform itself may also continue collecting account and usage data under its privacy policy. Privacy settings matter, but so does the follower list. A private account is only as private as the people who have been allowed in.

Online grooming often begins with behavior that does not look threatening at all. The National Center for Missing & Exploited Children says offenders may build rapport through compliments and shared interests, pretend to be younger, offer gifts or other incentives, introduce sexual conversation, or ask for explicit images. Moving a conversation from one platform to a more private messaging service is another tactic documented in online exploitation cases.

Secrecy, gifts, requests for personal or sexual images, pressure to move conversations elsewhere, threats, and an online contact who is unusually focused on gaining a child’s trust should all raise concern. Just as important, children need to know they can tell a parent or another trusted adult without automatically losing their phone or getting punished for coming forward.

Gaming does not come with one universal set of chat rules, and the defaults have changed on some major platforms. Roblox now requires an age check before users can access its communication features. Children ages 5 to 9 need parental consent for Experience Chat, and users under 16 need parental consent for Direct Chat. Minecraft takes a different approach: multiplayer is turned off by default on child accounts, and parents can control multiplayer and communication through Microsoft account settings.

The larger risk is still worth taking seriously. The FBI has documented offenders using gaming chats or voice communication to meet children, sometimes while pretending to be another child, and then trying to move the conversation to another app. Parents should check both the game’s settings and the console or platform account tied to it rather than assuming one set of controls covers everything.

Most parents would hope the answer is yes, but children do not always report uncomfortable online experiences. In a 2025 Family Online Safety Institute survey of 1,000 parents and 1,000 children ages 10 to 17, 89% of the children said they felt comfortable talking to a parent if something online made them feel unsafe. That is encouraging, but it still leaves 11% who did not say the same.

Organizations that work on online child safety also warn that some children stay quiet because they are embarrassed or afraid they will lose device privileges. Telling a child ahead of time that asking for help will not automatically result in punishment can remove one barrier to speaking up when something goes wrong.

Apps may request access to features and information such as the camera, microphone, contacts, photos, files, and location. Some permissions are necessary for an app to work; others may be optional. Both iPhone and Android let users review permissions in the device’s privacy settings and change access later.

A good rule is to ask whether the permission makes sense for what the app actually does. Camera, microphone, and location access can often be limited to while the app is in use, denied entirely, or changed later. Checking permissions on a child’s phone or tablet takes only a few minutes and can reveal apps that have more access than they need.

Many major social platforms use 13 as a minimum age in the United States, but the details are more complicated than a simple birthday box. Instagram and Snapchat generally require users to be at least 13, while TikTok has a separate, limited under-13 experience in the U.S. YouTube also allows children under 13 to use parent-managed supervised accounts. The minimums are influenced by COPPA and company policy, but COPPA itself does not simply require every service to set a 13-plus age limit.

It is also no longer accurate to say platforms do no age verification at all. Instagram uses age-verification and age-assurance tools in certain situations, TikTok uses several age-confirmation methods for some features and appeals, and Snapchat can require age verification when an account is flagged as underage. None of these systems makes age enforcement perfect. Parents should not assume that every account a child encounters belongs to someone whose age has been independently verified.

A 2025 Family Online Safety Institute study found that parental controls were far from universal. In its nationally representative survey of 1,000 parents and 1,000 children ages 10 to 17, around half of parents reported using parental controls on tablets, 47% on smartphones, and 35% on game consoles.

The controls available today can cover screen time, purchases, app downloads, content ratings, web access, communication, location sharing, and multiplayer features, depending on the device or service. The important part is not simply turning them on once. Review them when a child gets a new device or game, after major platform changes, and periodically as the child gets older and the settings need to change with them.

A digital footprint is the trail of information connected to a person’s online activity. It can include public posts and comments, accounts, usernames, photos, videos, forms, app activity, and other data recorded by online services. A child can have a digital footprint before creating an account of their own because parents, relatives, schools, teams, and other organizations may post information about them.

Not all of that information is public, and a college or employer cannot simply pull up someone’s private browser history. Public material is different. Posts can be copied, screenshotted, archived, or reposted, so deleting the original does not guarantee every copy disappears. Parents contribute to a child’s digital footprint too, which makes it worth thinking about how much identifying information gets posted on a child’s behalf.

Yes. Stolen personal information can circulate in criminal marketplaces and forums that are not indexed by ordinary search engines. A large education-sector breach showed how much information can be exposed at once: North Carolina’s attorney general said the 2024 PowerSchool breach affected more than 62.4 million current and former students and teachers nationwide. The exact data involved varied by school system, and some affected records included sensitive information such as dates of birth, contact information, Social Security numbers, or medical notes.

Identity-monitoring and breach-alert services can sometimes warn families that information has surfaced or is being misused, but they are not a complete view of every criminal site or database. For children, a free credit freeze with all three major bureaus is one of the more concrete preventive steps available. If a child’s identity is actually being misused, the FTC directs families to IdentityTheft.gov for a recovery plan.

This is less about one setting and more about everything that happens around it. Children can run into bullying, unwanted contact, scams, mature material, advertising, or attempts at sexual exploitation through social media, messaging apps, gaming chats, comments, and recommendation feeds. No parent can realistically watch every interaction, and trying to do that becomes less appropriate as children get older.

The better approach is a mix of age-appropriate controls and regular conversations about what children are seeing and who they are talking to. Ask them to show you the games and apps they use, talk about what would count as a red flag, and make it clear they can bring you something uncomfortable without getting a lecture first. Sometimes the most useful safety feature is simply making sure they know where to go when something feels wrong.