Online Safety for Kids: Privacy, Photos, Purchases and the Law

Online safety for young children comes down mostly to things you control: approve every purchase, keep privacy high and location off, think twice before posting your child's photos publicly, and choose apps without ads or open chat. Laws such as COPPA in the US and GDPR in Europe add real protections, but they don't replace your own checks.

In short

• The UK's Chief Medical Officers advise parents never to assume children are happy for their photos to be shared: "when in doubt, don't upload!"
• In-app purchases need a gate: in a 2014 FTC settlement, Apple agreed to refund at least $32.5 million for children's purchases parents had not approved.
• COPPA requires verifiable parental consent before apps collect personal information from children under 13; it does not ban under-13s from apps.
• Children under five generally cannot tell ads from other content, the UK's 2026 expert panel noted, so ad-free matters most for the youngest.

Which settings keep a young child safe online?

Start with four: purchase approval, parental controls, high privacy and location off.

• Purchases. On Apple devices, Ask to Buy sends you a notification when your child wants to download an app or make an in-app purchase. It needs a Child Account in Family Sharing. On other platforms, look in the store's family settings for the same thing.
• Parental controls. The AAP's Family Media Plan suggests controls for "time, downloads, contacts, purchases."
• Quieter defaults. Switch off autoplay, notifications and chat where you can. The AAP's January 2026 recommendations ask tech companies to make "turning off autoplay" and "turning off the chat feature" the default.
• Privacy and location. Choose the most private settings and keep location off. The UK's Children's Code requires services to start that way.

For how much screen time suits each age, see our screen time and digital balance guide.

Is it safe to share photos of your child online?

No way of sharing is fully safe, and the official advice leans toward sharing less. The UK's Chief Medical Officers put it plainly: "Parents and carers should never assume that children are happy for their photos to be shared. For everyone – when in doubt, don't upload!"

The AAP's guidance on "sharenting" says public sharing "can create risks like unwanted contact or exposure to predators online," and that others can take posted photos and "digitally alter them" with generative AI. It adds that "sharing online can never be 100% safe," and suggests you:

• keep accounts and albums private, and the audience small;
• leave out locations and identifying details such as school logos;
• ask your child's permission as they grow.

An emoji over the face is not enough on its own: a location tag or a school logo can identify a child just as well.

How do you stop in-app purchases and ads aimed at kids?

Turn on purchase approval before you hand over a device, and prefer apps with no ads at all. Both problems have led to large US Federal Trade Commission (FTC) settlements.

• Apple, 2014. Apple agreed to refund at least $32.5 million. The FTC's complaint said entering a password opened "a 15-minute window in which children can incur unlimited charges with no further action from the account holder."
• Epic Games, 2022. The Fortnite maker agreed to pay $245 million in refunds over alleged "dark patterns" that let children "rack up unauthorized charges without any parental involvement," plus a $275 million COPPA penalty.

Ads are a bigger issue the younger the child. The UK's 2026 expert panel noted that "children under five years are not generally able to distinguish advertising from other content in programmes." The FTC also says it remains concerned about push notifications used "to keep kids online."

What does the law say about children's data?

These laws regulate data and design rather than banning children from apps: a parent's consent is needed before most services collect a young child's personal information, and the age depends on where you live.

• COPPA's 2025 update. The FTC's amendments require separate parental consent before children's data is shared with third parties for targeted advertising, bar keeping it indefinitely, and count biometric identifiers as personal information. The final rule took effect on 23 June 2025, with compliance due by 22 April 2026.
• GDPR. Article 8 sets 16 as the default; member states may lower it, but "not below 13 years."
• The UK. Children aged 13 or over can give their own consent, the UK CMOs note. The ICO's Children's Code sets 15 standards for services "likely to be accessed by children under the age of 18, even if it's not aimed at them."

Are connected toys, smart speakers and AI apps safe?

Treat anything that listens or chats as an app that collects data. The UK government's 2026 guidance for under-5s says: "Don't let young children use AI toys, tools or chatbots until there's more evidence on how they affect your child," naming "interactive robots, smart speakers or AI chat apps."

Common Sense Media advised in January 2026 that parents avoid AI toys for children aged 5 and under and "exercise extreme caution" for ages 6–12. In its tests, "27% of AI toy outputs were inappropriate for kids" (a nonprofit's assessment, not a peer-reviewed study). We go deeper in AI and child development, and if a homework helper is on the table, in our guide to AI tutors.

How do you choose a safe app for your child?

Look for an app that would pass the rules above even where they don't apply:

1. No ads, or at the very least no targeted ads.
2. Accounts are for adults, or the app asks for your consent before collecting your child's data.
3. Private by default: photos, profiles and location start private or off.
4. Asks only for what it needs, with no nudges to share more or switch privacy off.
5. Purchases go through you, via Ask to Buy or a parent gate.
6. No open chat with strangers, and shared content can be reported or blocked.
7. Autoplay and notifications can be switched off.
8. You can delete your child's data.
9. It says whether it uses AI, and what for.
10. A grown-up controls time limits.

How do you talk to your child about staying safe online?

• Ages 3–5: "If anything on a screen makes you feel funny or scared, come and tell me. You won't be in trouble."
• Ages 6–8: "We don't tell apps or people online our full name, our school or where we live."
• Any age: "Can I send this photo of you to Grandma?"

How does MiniMinds handle this?

MiniMinds, the story app behind this blog, covers several of these points: no ads anywhere, accounts are for adults, a grown-up sets a screen-time limit for each session, photos a family turns into art are private by default, and stories other families share can be reported or blocked. It uses AI to write and illustrate stories, so with a child under five, follow the UK advice above: you make the story and read it together. MiniMinds is not endorsed by any of the bodies quoted here. Stories families chose to share are in the free story library, including narrated stories.

Sources

1. Federal Trade Commission (2025). FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' Data. FTC. link
2. Federal Trade Commission (2025). Children's Online Privacy Protection Rule; Final Rule, 90 FR 16918. Federal Register (GPO). link
3. European Union (2016). Regulation (EU) 2016/679 (GDPR), Article 8 (CELEX 32016R0679). Official Journal of the EU. link
4. European Union (2022). Regulation (EU) 2022/2065 (Digital Services Act), Article 28. Official Journal of the EU. link
5. Information Commissioner's Office. Age appropriate design: a code of practice for online services. ICO. link
6. UK Chief Medical Officers (2019). UK CMO commentary on screen time and social media map of reviews. DHSC. link
7. American Academy of Pediatrics. Sharing Photos and Videos of Children on Social Media. AAP. link
8. American Academy of Pediatrics (2026). AAP releases new media recommendations (news, 20 January 2026). HealthyChildren.org. link
9. American Academy of Pediatrics (2026). How to Make a Family Media Plan. HealthyChildren.org. link
10. Early Years Screen Time Advisory Group (2026). Screen use by children aged under five: independent report. DfE/DHSC. link
11. Federal Trade Commission (2014). Apple Inc. Will Provide Full Consumer Refunds of At Least $32.5 Million… FTC. link
12. Federal Trade Commission (2022). Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars… FTC. link
13. Apple. Approve what your child can purchase and download with Ask to Buy. Apple Support. link
14. UK Government, Best Start in Life (2026). Baby and toddler screen time guidance. DfE/DHSC. link
15. Common Sense Media (2026). Common Sense Media Warns Against AI Toy Companions After Research Reveals Safety Risks. link