Staying safe online: the basics by age, and the ladder that hands over independence

Safety & independence · 9 min read

General information only, not legal or professional advice. Online risks and platform rules change often — check the current guidance for the apps and services your child actually uses, and judge readiness by your own child, not by age alone.

Online safety advice usually arrives as one of two unhelpful shapes: a single list of rules meant to cover a 6-year-old and a 14-year-old at once, or a shelf of separate guides, one per age band, that a parent has to stitch together alone. Neither shape matches how independence actually grows. A child does not need every rule on the first day they touch a tablet, and a teenager cannot be governed by the rules written for a kindergartner. What works is a ladder: a small set of basics at each stage, freedom that expands when the basics are demonstrated, and two pieces of infrastructure most guides skip — a proper setup session the day any new account is created, and a reporting agreement that keeps a child telling you what happened when something goes wrong.

Start with the principle: talk first, tools second

The Federal Trade Commission's parent guide, Net Cetera, states its thesis plainly: the first step to protecting kids online is more about talking than technology. Communicating your values and expectations is what helps kids make smarter decisions in the tricky situations no filter can anticipate. The FTC's practical corollaries matter as much as the thesis. Start early — as soon as a child starts using a phone, device, or computer, it is time to talk about online behaviour. Do not wait for the child to raise it; use everyday opportunities. And deliver it in small doses, repeated: most kids need to hear information more than once, in small pieces, for it to sink in.

Tools still have their place, and the evidence supports the pairing. The Lethbridge Police Service's parent guide summarises the research position: children with household rules are less likely to engage in risky online behaviour, and pairing parental controls with ongoing, open conversation improves kids' online safety. Controls without conversation leave a child defenceless the first time they are on someone else's device; conversation without controls asks a young child's judgement to do work it is not ready for. The ladder below assumes both, in that order.

The basics by age band

Common Sense Education sequences its privacy and safety curriculum by grade band, and the progression is a sound skeleton for a household version — the concepts genuinely do arrive in this order.

Stage	The basics to teach	What independence looks like
First use (roughly grades K–2)	What information is safe to share and whom to trust; basic privacy concepts; tell a trusted adult about anything online that feels risky or strange	Shared or family devices only, in shared rooms, with an adult nearby; no accounts of their own
Building (roughly grades 3–5)	Personally identifiable information — what it is and why it is private; strong usernames and passwords; safety in online gaming; recognising phishing and clickbait; how their data is tracked; using privacy settings to control what they share	A first account or two, created in the setup session below, settings reviewed together; gaming with chat limits set; an adult knows every password
Expanding (roughly grades 6–8)	Digital footprint — posts and photos persist and spread; how personal data is collected and monetised; reading terms of service for what an app actually takes; location-sharing norms and pressure; more advanced risk assessment of new situations	More accounts and messaging with known friends, privacy settings self-checked with spot reviews; location sharing off by default, decided case by case
Teen years	Applying the risk-assessment habit to new apps and features without being taught each one; reputation and future consequences of posts; recognising manipulation, scams, and pressure in messages; knowing exactly what to do — and that they can come to you — when something goes wrong	Broad independence with agreed check-ins; the reporting agreement below does the work rules used to do

Two basics from Common Sense's family tips for the elementary years deserve to be said exactly, because children remember concrete versions. First, the personal-versus-private distinction: some information is fine to share, like a favourite colour, and some is private, like a home address — and a young child can be taught to sort questions into those two piles before they can spell "privacy". Second, the quiz rule: kids should learn to identify and avoid clickbait, quizzes, special offers, and anything that asks for personal or private information, because a cheerful quiz is one of the standard ways information gets collected from children.

The independence ladder: freedom expands when skills show

Common Sense's stated reason for teaching frameworks instead of fixed rules is that prescriptive do's and don'ts go out of date quickly; children need risk-assessment skills they can apply to technologies that do not exist yet. A household ladder operationalises that: each rung is a freedom, and each freedom is unlocked by a demonstrated skill, not by a birthday.

Rung 1 — Use together. Skill shown: can sort personal from private information and names a trusted adult. Freedom: uses family devices in shared spaces.
Rung 2 — First accounts, set up together. Skill shown: can build a strong password, explain why it stays private, and find the privacy settings on a new app. Freedom: one or two accounts, settings reviewed together, parent holds the passwords.
Rung 3 — Messaging and multiplayer. Skill shown: recognises phishing, clickbait, and quiz traps; knows chat is for people they know in real life, or whatever boundary the family has set. Freedom: messaging and online play within that boundary.
Rung 4 — Self-managed settings. Skill shown: on a brand-new app, unprompted, checks privacy settings, turns location off, and reads what data the app collects before using it. Freedom: new apps approved by a quick report of those three checks instead of a full joint inspection.
Rung 5 — Independent with check-ins. Skill shown: a track record of reporting incidents — including their own mistakes. Freedom: broad independence, spot check-ins, and the reporting agreement as the standing safety net.

A rung can be paused without drama. A child who shares a password with a friend goes back to reviewed settings for a while — the ladder moves down as calmly as it moves up, and treating that as ordinary mechanics rather than disgrace is what keeps the reporting agreement alive.

The first-account setup session

Common Sense's family tips advise going through the settings on all new apps together, so parent and child both know what information is being shared — and, especially at the beginning, sharing very little. Run as a numbered session on the day the account is created, it looks like this:

Choose the username together. No full name, no birth year, no school or team name — a handle that identifies the child to friends and to nobody else.
Build the password together. Common Sense's method: a complex password built from a phrase plus special characters — hard to guess, easy for the child to remember. Say the rule out loud: passwords stay private, are never shared with friends, and get changed regularly; at the early rungs, a parent also knows and records it.
Set the profile to the most private option. Work through the privacy settings screen by screen, together, choosing the least-sharing option at every step. If a setting is unclear, the private choice is the default until it is understood.
Turn location off. Common Sense's family tips are direct: avoid location tracking, turn location features off where possible, and use location-aware apps with caution. Check both the app's own setting and the device's permission for that app.
Decide the contact rules before the first contact. Who may be added — people known in real life is the common early boundary — and what happens when a stranger messages anyway: do not reply, screenshot, tell a parent. Agree it now, while it is hypothetical.
Finish with the reporting agreement (below), restated for this account specifically.

What success looks like: the session takes twenty minutes, the child can afterwards show you — unaided — where the privacy settings live, whether location is on or off, and what the password rule is; and the parent's spot-check a month later finds the settings exactly where the session left them.

The no-panic reporting agreement

Every other part of this system depends on one flow of information: the child telling you what happened. That flow has a known failure mode — children hide incidents when they expect panic, anger, or instant confiscation of the device, which converts a small, fixable problem into a secret one. The FTC's guidance points at the counter: work hard to keep the lines of communication open, even if you learn your child has done something online that you find inappropriate, and be patient and supportive rather than rushing to judgement.

Make it an explicit agreement, stated before anything has gone wrong, in roughly these terms: if something online scares you, confuses you, or feels wrong — or if you broke a rule yourself — tell me. The first thing that happens is we fix the problem together. The device is not automatically taken away for reporting, and honesty about a mistake is never the thing that gets punished. Consequences for deliberate rule-breaking still exist; they are decided calmly, later, and they are never triggered by the act of reporting itself. A child who has tested this agreement once on something small — and watched the parent stay calm — will use it on something big. A child who has only heard it has a hypothesis. Give them the small test early: ask about near-misses, and treat every report, however minor, as the system working.

FAQ

What age should a child get their first account?
There is no single right age in the guidance — the staged sources organise by readiness concepts, not birthdays, and platforms set their own minimum ages in their terms, which are a floor, not a recommendation. Use the ladder instead: a first account belongs at the rung where the child can sort personal from private, build and guard a password, and find the privacy settings. For most children that cluster of skills lands in the later elementary years.

Should I use parental control tools?
Yes, as the second layer — the police guidance above notes the research finding that controls paired with conversation improve safety, and most platforms expose privacy, content-filter, and time-limit controls through a family centre (searching the app's name plus "family centre" is the usual way to find them). Controls set the floor; the ladder and the conversations build the judgement that works on devices you do not control.

My child already has accounts we never set up together. Is it too late?
No — run the setup session retroactively. Sit down together, go through the existing accounts' settings screen by screen, change weak or shared passwords, turn location off, and agree the contact rules and the reporting agreement now. Frame it as the standard procedure for every account in the house, including the retroactive pass, not as a response to suspicion.

What should a child do the moment something goes wrong?
Stop, do not reply or delete anything, screenshot it if they can, and tell a trusted adult. That sequence — the school-age version of it is "tell a trusted adult about risky situations," the very first concept in Common Sense's progression — stays the same at every rung. What changes with age is only how much of the fixing the child can help with.