Family Online Safety UK

Most UK parents worry about what their children are doing online. That worry is reasonable. But the gap between concern and action is often enormous, partly because the landscape of devices, platforms and laws is genuinely complicated, and partly because no single guide has ever pulled it all together in one place. This one does.

What follows is a practical framework for every household: how the major device ecosystems handle parental controls, what UK law now requires of the apps your children use, how to handle the specific risks facing teenagers and neurodivergent children, and what to do when something goes wrong. We have also linked to detailed platform-specific guides throughout, so you can go as deep as your situation requires.

What is family digital safety and why does it matter in 2026?

Family digital safety is the combination of technical controls, parental mediation, legal rights and ongoing conversation that keeps every member of a household safer online. It is not a product you buy once and forget. It is a practice, and it has to evolve as children grow.

The scale of the challenge is worth understanding clearly. Ofcom's research shows that 99% of UK children aged 3 to 17 went online in 2024/25. By age 12, 76% own a smartphone. And 69% of 12 to 15-year-olds use social media, with many lying about their age to access platforms that require users to be 13 or older. These are not marginal figures. This is the baseline reality of childhood in the UK right now.

The threats that come with that connectivity range from the mundane to the serious. At the milder end: excessive screen time, sleep disruption, exposure to age-inappropriate advertising. At the serious end: self-harm and suicide content (nearly 1 in 4 children have encountered it, according to NSPCC research), online grooming, financial scams targeting teenagers, and the rise of self-generated child sexual abuse material, which the Internet Watch Foundation has tracked rising year on year, much of it originating from children's own bedrooms.

The response to these risks has three distinct layers. The first is technical: parental controls, content filters and screen-time management built into devices and broadband routers. The second is legal: the UK Children's Code and the Online Safety Act now place statutory obligations on the platforms and apps your children use. The third is human: the conversations, boundaries and trust you build with your children over time. None of these layers works without the others. A child who has been taught to bypass a content filter will do so. A platform that complies with the Children's Code but whose parent hasn't checked the privacy settings still poses risks. And a family that relies only on conversation without any technical safeguards is leaving a lot to chance.

One more thing worth saying upfront: this is not just about young children. The risks shift as children age, and the tools need to shift with them. Teenagers face different threats to ten-year-olds. Neurodivergent children may be more vulnerable in specific ways. And older relatives sharing devices introduce a different category of risk entirely. A genuinely useful family safety framework has to account for all of them.

Understanding UK law: the Children's Code and Online Safety Act explained

Two pieces of legislation now shape what apps and platforms must do to protect children in the UK. Understanding them is not optional for parents. Knowing your rights changes what you look for in an app's settings and what you can demand from a platform when something goes wrong.

The UK Children's Code (formally the Age Appropriate Design Code) is a statutory code under section 123 of the Data Protection Act 2018. It comprises 15 standards that any online service likely to be accessed by children must follow. The headline requirements are: high privacy by default (not opt-in), geolocation turned off unless strictly necessary, profiling for commercial purposes switched off by default, no nudge techniques that push children toward sharing more data or weakening privacy settings, and a requirement to consider the best interests of the child in design decisions. The Information Commissioner's Office enforces it and can issue significant fines for non-compliance.

What does this mean practically? If you open the privacy settings on an app your child uses and find that ad personalisation is turned on by default, that location sharing is enabled, or that there is no easy way to turn off data collection, that app may not be meeting its obligations under the Code. You have grounds to complain to the ICO. You should also treat that app with greater caution. Our detailed guide to understanding the UK Children's Code walks through exactly what each standard means and how to check whether a specific app complies.

The Online Safety Act 2023 is a broader piece of legislation that places duties of care on user-to-user services (social media, forums, messaging apps) and search engines to protect users, especially children, from illegal content and content harmful to children. Platforms must carry out risk assessments, implement age-appropriate safeguards, and apply proportionate age assurance. Ofcom is the designated regulator. It is publishing detailed codes of practice in stages, and platforms have deadlines to comply.

The Act also introduces the concept of age assurance: platforms must take steps to verify or estimate users' ages so they can apply appropriate protections. This does not necessarily mean ID checks for every user, but it does mean platforms can no longer simply ask users to tick a box saying they are over 13. What counts as proportionate age assurance is still being defined by Ofcom, but the direction of travel is clear: the burden of proof is shifting from children to platforms.

As a parent, the practical upshot of the Online Safety Act is that you should expect better reporting tools, faster content removal and published transparency reports from major platforms. You also have a legal basis to push back when platforms fail to act on reports of harmful content. Our spoke guide on the Online Safety Act and what it means for your family explains the timeline and what to do when platforms fall short.

Setting up parental controls across Apple, Google and Microsoft devices

The three major device ecosystems each have their own family safety framework, and they do not talk to each other. In a household with an iPhone, an Android tablet and a Windows laptop, you will need to configure three separate systems. That is genuinely inconvenient, but it is the reality, and each system is more capable than most parents realise.

Apple Family Sharing and Screen Time is the most polished of the three. Once you set up a Family Sharing group (via Settings on any Apple device), you can create a child account that links to yours. From there, Screen Time gives you granular control: daily limits by app category, downtime schedules, content restrictions by rating, and the ability to approve or block app downloads remotely. Communication limits let you control who a child can call or message. And Ask to Buy means any purchase requires your approval. The key thing most parents miss is that Screen Time is only as strong as the passcode protecting it. Use a six-digit code that your child doesn't know, and make it different from your device unlock code. Our full walkthrough of Apple Family Sharing and Screen Time controls covers every setting step by step.

Google Family Link works across Android phones, tablets and ChromeOS devices. You manage a child's Google account from the Family Link app on your own device. Controls include app approval, daily screen time limits, location sharing, and the ability to remotely lock a device. One important nuance: when a child turns 13, Google prompts them to take control of their own account. This does not mean all controls disappear, but it does mean you need to have a conversation before that birthday about what changes and what stays in place. The Google Family Link setup guide explains the full configuration process and the age-13 transition in detail.

Microsoft Family Safety covers Windows 10 and 11 PCs and, importantly, Xbox consoles. You manage it through the Family Safety app or at account.microsoft.com. Controls include screen time limits, content filters for Microsoft Edge, spending limits on the Microsoft Store, and location sharing. One underused feature is the weekly activity report, which gives you a clear summary of what apps and websites a child has used without requiring you to monitor in real time. For households with both a Windows PC and an Xbox, the fact that Microsoft Family Safety covers both is a genuine advantage.

Across all three platforms, the same principle applies: set controls early, use a strong parental account password, enable two-factor authentication, and revisit settings every few months as children's ages and needs change. A ten-year-old's settings should not be the same as a fourteen-year-old's.

Gaming consoles and connected devices: safety setup for PlayStation, Xbox and Nintendo

Gaming is where parental controls most often fall through the cracks. Parents who have carefully configured an iPhone and a laptop sometimes overlook the fact that a PlayStation or Nintendo Switch is a fully connected device with its own browser, messaging system, spending mechanism and, in many cases, voice chat with strangers.

Xbox is the most integrated of the three major consoles when it comes to family safety, precisely because Microsoft Family Safety spans both Windows and Xbox. Controls include content ratings for games and apps, the ability to require approval for purchases, screen time limits, and communication settings that control who a child can play and chat with online. You can set these from the Family Safety app on your phone without touching the console itself, which is useful. The one gap: if a child has a separate Microsoft account that isn't linked to your family group, those controls don't apply to it. Check that your child is using the account you've set up for them, not a secondary one.

PlayStation uses a Family Management system through the PlayStation Network. A family manager account (which must be over 18) can set spending limits, restrict online features, limit playtime and control what content ratings are accessible. The system is functional but less polished than Microsoft's, and the monthly spending limit rather than per-purchase approval is a notable difference. PlayStation also has a separate system for PS5 versus PS4, so if your household has both, check settings on each.

Nintendo Switch has a dedicated parental controls app (Nintendo Switch Parental Controls, free on iOS and Android) that is genuinely well designed. You can set play time limits, receive daily summaries, restrict online features and communication, and remotely suspend the console if a child exceeds their time. The app sends you a notification when the daily limit is approaching, which is more proactive than most console systems. Nintendo's approach to online communication is also more cautious by default than Sony's or Microsoft's, which suits younger children well.

Beyond the big three, smart TVs, Amazon Echo devices, and tablets like the Amazon Fire Kids deserve attention. Each has its own parental control system, and each can be a vector for accessing content that device-level controls on phones and laptops would block. Our dedicated guide to Xbox and PlayStation parental controls goes into the full setup process for each platform.

Age verification and content filtering: what works and what doesn't

Content filtering and age verification are the two tools parents most often reach for first. Both are useful. Neither is sufficient on its own, and both have significant limitations that are worth understanding before you rely on them.

ISP-level filtering is the broadest tool available. All major UK broadband providers (BT, Sky, Virgin Media, TalkTalk and others) offer free content filters that apply to every device on your home Wi-Fi network. They work at the DNS level, blocking categories of websites rather than individual pages. The advantage is coverage: one setting protects every device, including smart TVs and games consoles that don't have their own parental control apps. The limitations are equally significant. ISP filters are blunt instruments. They block entire categories, which means they can block legitimate educational content alongside harmful material, and they can miss harmful content that doesn't fit neatly into a category. More importantly, they only work on home Wi-Fi. The moment a child switches to mobile data on a smartphone, ISP filters do nothing.

Router-level filtering from third-party services (such as Circle or specific router firmware options) offers more granular control than ISP filters, including per-device settings and time-based rules. But the same fundamental limitation applies: it only covers devices on your home network.

App-level and device-level filtering (the Screen Time and Family Link controls described above) works on the device regardless of which network it's on. This makes it more reliable for mobile use, but it only covers the specific device and ecosystem it's configured on.

Age verification under the Online Safety Act is still evolving. Platforms are required to implement proportionate age assurance, but the technical standards are still being finalised by Ofcom. Current approaches range from self-declaration (a tick box, which is trivially bypassed) to credit card checks (which only work if a child doesn't have access to a parent's card) to more sophisticated methods like facial age estimation. None of these is foolproof. The honest position is that age verification as a technical system is still catching up with the legal requirement.

The practical upshot for parents: use ISP filters as a baseline, configure device-level controls as the primary layer, and don't assume either is catching everything. Our detailed guide to router and ISP content filtering tests the major UK providers and explains what each filter actually catches.

Protecting children from harmful content: self-harm, scams and exploitation

Technical controls reduce exposure to harmful content. They don't eliminate it. Nearly 1 in 4 children have seen content promoting self-harm or suicide online, according to NSPCC research, and that figure holds even in households with active parental controls. So the question isn't only how to prevent exposure, but how to respond when it happens.

Self-harm and suicide content is the area where parental anxiety is highest and guidance is most needed. The first thing to understand is that children who have seen this content don't always tell a parent immediately, and sometimes don't tell anyone. Creating an environment where a child feels safe to bring these things to you is more protective than any filter. If your child does come to you, or if you discover they've seen such content: stay calm, listen without judgement, and don't immediately confiscate devices or delete content (you may need it to make a report). Report to the platform using its abuse reporting tool. Contact Childline (0800 1111) or the NSPCC helpline (0808 800 5000). If your child is in immediate danger, call 999.

Online scams targeting children and teenagers are a growing problem. UK Finance has documented hundreds of millions of pounds lost to authorised push payment fraud, with social media a key vector. Scams targeting younger people tend to fall into a few categories: fake prize notifications, romance scams on gaming platforms and social media, 'money-flipping' schemes that promise returns on small investments, and phishing messages that impersonate brands children trust. The best protection is education: teach children that anyone asking them to keep a conversation secret from parents is a red flag, that no legitimate competition requires payment to claim a prize, and that they should always check with you before clicking a link or sending money. Our guide to protecting children from online scams and fraud covers the most common schemes and what to do if your child has been targeted.

Grooming and exploitation is the most serious risk and the one where the Internet Watch Foundation's data is most alarming. The rise of self-generated child sexual abuse material, much of it produced under coercion from adults who have groomed children online, is a documented and growing trend. The protective factors here are a combination of technical controls (restricting who can contact a child on gaming and social platforms), education about what grooming looks like, and an open relationship where a child feels able to tell you if an adult online is making them uncomfortable. If you suspect grooming or exploitation, contact the police or report to the Child Exploitation and Online Protection command (CEOP) at ceop.police.uk.

Digital safety for teenagers: balancing privacy, autonomy and protection

Teenagers are the group that existing online safety guidance most consistently fails. Most parental control tools are designed with younger children in mind, and most safety advice assumes a child who will accept restrictions without question. Neither assumption holds for a fifteen-year-old.

The fundamental shift required as children enter their teens is from control to conversation. This doesn't mean abandoning all technical safeguards. It means being transparent about what monitoring you're doing and why, involving your teenager in setting the rules, and gradually relaxing restrictions as they demonstrate they can handle more freedom. A teenager who has been involved in creating the boundaries is far less motivated to circumvent them than one who has had rules imposed without explanation.

Specific areas that need renegotiation as children age include: screen time limits (teenagers doing homework online need different rules to younger children watching YouTube), social media access (the question is less whether they use it and more which platforms and with what privacy settings), location sharing (some families find this reassuring; many teenagers find it intrusive, and the conversation about it matters), and messaging privacy (you might decide not to read private messages but continue to review app usage and contact lists).

The risks specific to teenagers also differ from those facing younger children. Authorised push payment fraud, where scammers impersonate banks or employers, is more likely to target teenagers who have their own bank accounts. Sexting and image-based abuse are risks that barely apply to ten-year-olds but are significant for fifteen-year-olds. Radicalisation and extremist content is more likely to reach teenagers who are actively searching for political or ideological material. And mental health content, both harmful and helpful, is consumed at much higher rates by teenagers than younger children.

The Online Safety Act's provisions on harmful content apply to teenagers as much as younger children, and platforms are required to implement age-appropriate safeguards for all under-18s. But the most effective protection for a teenager is a relationship in which they feel comfortable telling you when something online has made them uncomfortable or scared. That relationship doesn't come from a settings menu. Our full guide to digital safety for teenagers covers the specific risks, the right conversations to have, and how to adjust controls as your child matures.

Supporting neurodivergent children and those with mental health challenges online

Neurodivergent children, including those with autism, ADHD, dyslexia and other SEND (Special Educational Needs and Disabilities) profiles, often have a more intense relationship with online spaces than their neurotypical peers. This is not a problem in itself. Online communities can provide connection, understanding and a sense of belonging that is harder to find in person. But it also means that the risks of excessive screen time, exposure to harmful content, and online exploitation can be more acute, and that standard parental control tools may not be well suited to the specific needs of these children.

Children with ADHD, for example, may find screen-time limits particularly difficult to accept because the immediate reward of online engagement is especially compelling relative to the abstract benefit of stopping. Rigid time limits can trigger significant distress. A more effective approach for many families is to focus on what comes before and after screen time (outdoor activity, face-to-face interaction) rather than enforcing hard cut-offs, and to involve the child in choosing how their screen time is allocated.

Autistic children may develop intense interests in specific online communities or games, which can be protective (providing a social outlet) but also risky (making them potentially more trusting of online strangers who share their interest). The protective factor here is helping your child understand that online relationships, even with people who seem to share their interests, need the same caution as offline relationships with strangers.

Children with mental health challenges, including anxiety and depression, are more likely to seek out content that reflects their emotional state, which can mean encountering self-harm and suicide content through recommendation algorithms rather than active searching. The Children's Code's requirement that platforms turn off profiling and algorithmic recommendation for children by default is directly relevant here, but compliance is uneven. Check the settings on any platform your child uses for options to disable personalised recommendations.

Standard parental control tools rarely account for these nuances. They apply the same blunt time limits and content blocks regardless of a child's individual needs. Families supporting neurodivergent children often benefit from a more tailored approach, combining selective use of technical controls with specialist advice from SEND support services. Our detailed guide to supporting neurodivergent children online covers the specific considerations for different SEND profiles and practical adjustments to standard parental control tools.

Keeping older relatives safe: shared devices, scams and remote access

Family digital safety is not only about children. Older relatives, whether they live with you or are simply supported by you, face a distinct and often underappreciated set of online risks. And in many households, the same devices are shared across generations, which creates its own complications.

The most significant risk for older adults online is financial fraud. Authorised push payment scams, where fraudsters impersonate banks, HMRC or utility companies to convince someone to transfer money, disproportionately affect older people. So do romance scams, fake investment schemes, and phishing emails that mimic trusted institutions like the NHS or Royal Mail. UK Finance data consistently shows that older adults lose disproportionate amounts to these scams, in part because they may be less familiar with the tactics used and in part because they may be more trusting of official-looking communications.

Remote access scams deserve special mention. These are calls or messages claiming to be from a tech support company (sometimes impersonating Microsoft or BT) that convince the target to install software giving the scammer control of their device. Once installed, that software can access banking apps, steal passwords and transfer funds. The key message for older relatives: no legitimate company will ever call you unsolicited and ask you to install software or give them remote access to your device. If this happens, hang up and call the company back on a number you find independently.

Shared devices create a specific problem: parental controls designed for children can inadvertently restrict an older adult's access to legitimate content, and an older adult's account on a shared device may not have the same security settings as the primary user's. The simplest solution is separate user accounts on shared devices, each with its own password and settings. On Windows, this is straightforward. On shared iPads or Android tablets, it requires more deliberate setup.

If you're supporting an older relative remotely, consider setting up a password manager for them (reducing the risk of weak or reused passwords), enabling two-factor authentication on their most important accounts, and having a regular conversation about any suspicious contacts they've received. Our guide to keeping older relatives safe online covers the setup steps and the conversations worth having.

Where to go next

This guide has given you the framework. But the details matter, and the details vary by platform, by age group and by specific risk. Here is where to go deeper on each area.

If your household runs Apple devices, our guide to Apple Family Sharing and Screen Time controls walks through every setting from initial family group setup to content restrictions and remote approval for app downloads. For Android and ChromeOS, the Google Family Link setup guide covers the full configuration process, including what happens when your child turns 13 and Google prompts them to take control of their own account.

Gaming is where controls most often get overlooked. Our guide to Xbox and PlayStation parental controls covers both platforms in detail, including the differences between PS4 and PS5 settings and how Microsoft Family Safety spans both Windows and Xbox in a single app.

On the legal side, the UK Children's Code explained for parents translates the 15 statutory standards into plain language and tells you exactly what to look for in an app's settings. And our guide to the Online Safety Act and your family explains the timeline, what Ofcom is doing, and what you can do when platforms fail to meet their obligations.

For specific risks: protecting children from online scams and fraud covers the most common schemes targeting young people and what to do if your child has been targeted. Our guide to digital safety for teenagers addresses the specific risks and the shift from control to conversation that the teenage years require. And for households with neurodivergent children or older relatives, our dedicated guides to SEND digital safety and keeping older relatives safe online provide the tailored guidance that general parental advice rarely offers.

The NCSC's Cyber Aware guidance is also worth bookmarking for password management and account security advice that applies across every device in your household. Family digital safety is not a one-time setup. It is an ongoing practice, and the more informed you are, the better equipped you are to adapt as your family's needs change.