We are all working, learning and socialising online more than we ever have. More accounts, more devices, more services holding a piece of the family's information — and almost none of it reviewed since the day it was set up.
A privacy and security check-up is not a project. It's twenty minutes, once a term, done together with your child so they learn the routine rather than just receiving the result.
Here's the list.
1. Passwords (5 minutes)
Three rules, in order of importance:
- Unique for the accounts that matter. Email first — always email first, because it's the account that can reset every other one. Then anything with money attached, then the main social account.
- Long beats complicated. Four unrelated words is stronger and far more memorable than a short string with a symbol wedged into it.
- Use a password manager. Every browser and phone has one built in. The commonest objection is "I'll forget the master password," which is exactly why you write that one down and keep it somewhere physical.
The realistic version for a family: don't try to change forty passwords today. Change the email password, make it unique, and put the rest in the manager as you encounter them.
2. Two-factor authentication (5 minutes)
Two-factor is the highest-value five minutes in this entire article. A stolen password alone stops being enough.
Turn it on for email and the main social accounts, at minimum. If the service offers a choice, an authenticator app is better than SMS — but SMS is far better than nothing, and for a family the version that gets switched on is the one that counts.
Save the backup codes somewhere that isn't the phone.
3. App permissions (5 minutes)
Open Settings → Privacy on each device and go through the four that matter:
- Location — set to "while using" at most, and off entirely for anything that isn't maps.
- Camera and microphone — anything that surprises you, revoke it. Nothing breaks permanently; the app will ask again if it genuinely needs it.
- Contacts — the permission most quietly abused. Very few apps need your child's address book.
- Photos — where the option exists, grant access to selected photos rather than the whole library.
Do this with your child rather than for them. It takes the same time and teaches the habit. It's also step four of the monthly app audit.
4. Old accounts (5 minutes)
Every unused account is a small liability: it holds data, it can be breached, and nobody is watching it. The forum from three years ago, the game signed up for once, the account made for a school project.
Delete two per check-up. It's a small enough number that it actually happens.
While you're there, check whether the family's email addresses appear in any known breach — several reputable services let you search this for free — and change the password anywhere they do.
5. The social settings sweep
Four settings, on every platform, wherever they're hidden this year:
- Who can see the account — private, for a child, without argument.
- Who can message — friends and contacts only.
- Who can comment — restricted.
- Location tagging — off, for the reasons in what a post gives away.
Platforms reset these more often than you'd think, particularly after a major app update. That's the entire reason this is a repeating check-up rather than a one-off.
Make it a habit, not an event
Put it in the calendar once a term — start of term, mid-year, start of summer. Twenty minutes, both of you, at the kitchen table.
The value isn't only the settings. It's that your child sees privacy as ordinary maintenance rather than an emergency response to something going wrong, and that a conversation about their accounts becomes a normal, unremarkable thing to have.
For the household version of the same idea — agreements, conversations, and the checks worth repeating — see The Parent's Playbook.