Internet Safety for Tweens and Teens: A 2026 Parent’s Guide
Bottom line up front
The habits that keep tweens and teens safe online are boring, and they work: phones charge outside the bedroom at night, strange messages get shown to a parent instead of answered, the apps’ teen settings are switched on, and telling you fast never costs them their phone. Nearly everything that goes wrong for kids online, from free-Robux phishing to sextortion, starts with a message from someone they don’t know and runs on secrecy. Break the secrecy and most of the scams break with it.
Jump to: the settings, app by app · how sextortion unfolds · what to do if something already happened
Every parent wants the same thing: a kid who can use the internet without getting hurt by it, and one who’ll come tell them when something goes sideways. Nobody wants the version where you sit your eleven-year-old down with a printed list of rules and read them out loud. They’ll nod, walk away, and quietly decide you don’t understand anything.
So this is not that. What follows is the practical, age-by-age stuff that holds up in real households, with five figures you’re welcome to print, including a household agreement for the fridge. Pew’s 2024 teen survey found 95% of US teenagers use YouTube, 67% use TikTok, and almost half describe themselves as online “almost constantly.” The internet isn’t a place your kid visits anymore. It’s a place they live. The job is to help them live there well.
What changed in 2026
If your mental model of online danger is “a stranger in a chat room,” you’re fighting the last war. Four things have shifted under our feet since 2025:
AI-generated everything. Scam texts no longer have typos. Voice clones can be built from three seconds of a TikTok video, and our writeup of the AI voice cloning scam covers what one grandmother lost in an afternoon. Teens get the same trick in a different wrapper — usually a fake DM from a friend whose account “got hacked.”
AI companions and chatbots. Common Sense Media’s 2025 survey found 72% of US teens had used an AI companion like Character.AI, and about a third had chosen one over a real person for a serious conversation. Wrongful-death lawsuits in 2024–2025 alleged chatbot conversations contributed to teen suicides, and in September 2025 the FTC ordered seven companies to explain how they test companion bots for harm to kids. Character.AI then ended open-ended chats for under-18s that November, and ChatGPT added parental controls. The apps moved. Your kid’s habits may not have.
Sextortion has industrialized. NCMEC received more than 50,000 reports of financial sextortion in 2025, about 137 a day, up from roughly 36,000 in 2024. Targets are overwhelmingly teen boys, and NCMEC knows of at least three dozen US boys who took their own lives after being targeted. The script, laid out step by step below and in our guide to teaching kids about online scams, is a fake girl, a swapped photo, and an instant payment demand. Most parents still don’t know it exists, which is exactly why it works.
The platforms finally moved the defaults. Instagram puts under-18s in Teen Accounts and, since late 2025, a stricter content setting modeled on PG-13 ratings. Roblox has required an age check to use chat since January 2026. TikTok starts every under-18 account with a 60-minute daily limit. None of it replaces you, and all of it depends on your kid’s real birthday being on the account. But it means a ten-minute settings session now does more than it did a year ago.
What hits hardest at each age
Internet safety isn’t one conversation. It’s the same conversation, in different clothes, every two years. The threats shift fast, and the version that worked when your kid was nine will sound babyish at fourteen.
Ages 9–12. The risks are mostly about games and group chats: fake “free Robux” and “free V-Bucks” pages that harvest logins, strangers in game chat and Discord servers, and the cruelty that happens in a class group chat at 10pm. The conversation: free is a flag.
Ages 13–15. Direct messages from strangers, account-takeover tricks (“I sent you a code by mistake, can you send it back?”), sextortion, and AI companion apps that start filling the space friends used to. The conversation: name sextortion out loud before anyone tries it.
Ages 16–18. The scams look like the ones aimed at adults because, functionally, they are: fake jobs and “easy money” task apps, rental and ticket scams, crypto pitches, and phishing pages for real bank and school logins. The conversation: you’re a target now, and here’s how to check.
The five conversations every household needs
1. “What you post is forever, even when you delete it.”
Tweens don’t have a working theory of permanence. Twelve-year-olds will post things at 9pm they’d cringe at by 9am, and the screenshot will outlive them both. The version that lands isn’t a lecture about colleges and future employers — it’s a story. Tell them about someone you know who got burned by an old post. The point: everything they put online is recorded by someone, and the only safe assumption is that the most embarrassing version could end up in front of the worst person to see it.
2. “If a stranger DMs you, the move is to show me.”
This single rule — show me, don’t reply — collapses ninety percent of the threat. It works for Discord pings, Snapchat adds, Instagram message requests, the friend whose account “got hacked” and now wants a phone number. It needs to be set up so showing you is praised, not punished. The moment your kid hears “why are you even on Snapchat at this hour” the first time they bring you a weird DM, you’ve lost the rule for good.
3. “The phone sleeps in the kitchen.”
Most of the worst stuff that happens to teens online happens between 11pm and 2am, in the bedroom, alone, exhausted. Pew, the AAP, and the Surgeon General all agree: devices out of the bedroom at night is the single highest-leverage rule in any household digital agreement. It’s also the rule that gets the most pushback. Hold the line. A charging station in the kitchen, plus a $14 alarm clock, solves it.
4. “AI is a tool. It is not a friend, and it is not your therapist.”
This is the conversation that didn’t exist three years ago. AI-companion apps sit on millions of teen phones. Character.AI has since closed open-ended chat to under-18s, but smaller companion apps haven’t all followed, and general-purpose chatbots can drift into the same role if a lonely kid keeps talking. Some teens use them for homework. Others use them in ways that look more like an emotional relationship, sometimes with romantic or sexual roleplay layered in. The line for most families: AI tutors are fine with supervision; AI “girlfriends,” AI therapists, and chatbots designed to simulate intimacy should be a hard no for under-sixteens. For older teens, the rule is that the real humans in their life still get the secrets. The bot doesn’t.
5. “If something goes wrong, tell me. I won’t take your phone.”
This is the most important one, and the one parents most often blow. A kid who sent a photo, lost money to a Roblox scam, or let a stranger talk them into a video call is sitting on a secret that gets worse every hour they hold it. The biggest factor in scam recovery is how fast the kid tells someone. Make the math obvious: telling you fast is rewarded; hiding is what gets the phone confiscated. Say it before something happens, and again after.
If sextortion is happening right now
Do not pay. Stop responding. Screenshot everything, block the account, and report to the platform, the NCMEC CyberTipline (1-800-843-5678 / CyberTipline.org), and the FBI at ic3.gov. NCMEC’s Take It Down service can help remove images that were already shared, and since May 2026 apps must take such images down within 48 hours of a valid request (here’s how to file one). You can also call the FBI at 1-800-CALL-FBI or report at tips.fbi.gov; local field offices have sextortion coordinators. Lead with relief when your kid tells you — the first sentence is “I’m so glad you told me.”
How sextortion unfolds, and where to break it
Financial sextortion is the fastest-growing serious threat to teenagers online, and it runs on a script that barely changes from case to case. Knowing the script is most of the defense, because the person running it is counting on a panicked kid who has never heard of it.
Sources: NCMEC 2025 financial sextortion data (published 2026); FBI field-office warnings on financially motivated sextortion of minors, 2026; NCMEC Take It Down.
Three things make the script fail. Not moving apps: almost every version pushes the conversation from wherever it started to somewhere more private, and “I don’t switch apps for people I haven’t met” stops it at step two. Telling an adult: the scammer’s leverage is shame and a ticking clock, and both evaporate the moment a parent knows. Not paying: payment doesn’t end it. It marks your kid as someone who pays, and the second demand usually arrives within the hour. For the full minute-by-minute response, see our sextortion parent playbook.
Is this message a scam? Four questions your kid can ask
You can’t pre-screen every message your kid gets. You can give them a filter fast enough to run in their head before they reply. These four questions catch the scams that reach tweens and teens most often, from gaming phishing to account takeover to sextortion, and they’re short enough to stick.
The second question does the most work. Scams almost always need to move your kid somewhere: a different app where nobody’s watching, a login page that steals the password, a “verification” bot in a Discord server, a payment page. Real friends rarely need you to go anywhere to keep talking. If your teen wants a second opinion before anyone clicks, our free text message scam checker runs in the browser without uploading anything, and the link checker follows a link from our servers so they never have to open it themselves.
The household digital agreement
Written rules work better than verbal ones, especially with teens. Not because they sign anything — they don’t care about your contract — but because writing it down forces you to be specific. Here’s the version most families I work with end up at, more or less:
Print it, sign it, stick it on the fridge. Revisit it every birthday; the threats keep moving.
Parental controls that actually move the needle, app by app
Tech controls are a backstop, not a substitute for the conversation. But the defaults got meaningfully better in 2025 and 2026, so ten minutes in the settings buys more than it used to. Here’s what’s worth switching on, as of October 2026:
Sources: Apple, Google, Meta, TikTok, Snap, Discord, Roblox and OpenAI help and newsroom pages, checked October 2026.
- iPhone: Screen Time + Communication Safety. Set app limits and Downtime, and check that Communication Safety is still on. It blurs nude images in Messages and is on by default for children under 18 who use a child account in Family Sharing.
- Android: Google Family Link. App approval, content filtering, daily limits and a bedtime. Pair with YouTube’s supervised experience for younger tweens.
- Instagram: Teen Accounts. Under-18s are placed in Teen Accounts: private by default, messages limited to people they follow or are connected to, sleep mode from 10pm to 7am, and the stricter “13+” content setting. Under-16s need a parent’s permission, through supervision, to loosen any of it.
- TikTok: Family Pairing. Accounts for 13–15-year-olds are private by default and can’t use direct messages, and every under-18 account starts with a 60-minute daily limit. Family Pairing lets you lock those in from your own phone.
- Snapchat & Discord: Family Center. Both show who your teen talks to, not what they say. Snapchat’s January 2026 update added context on new friends (mutual friends, whether they’re in your teen’s contacts), average daily time, and a button to request their location. Smoke detectors, not polygraphs.
- Roblox: linked parent account. Chat now requires a facial age check (or ID for 13 and up), and players can only chat with people in nearby age groups. Link a parent account to set spending limits and lock the settings so a friend can’t flip them during a sleepover.
- ChatGPT and other AI apps. OpenAI’s parental controls link your account to your teen’s: you can set quiet hours and turn off voice, image generation and memory, but you can’t read their conversations. For companion apps that offer none of this, the rule from conversation four applies.
- 2FA on every gaming and social account. Use the platform’s authenticator app, not SMS. SIM-swap attacks are real.
None of these save you if the relationship isn’t there. All of them help if it is.
The five-minute audit
Sit next to your kid this weekend — on the couch, with snacks, not at the kitchen table — and do three things together: check that 2FA is on for their main accounts, set their social profiles to private, and unfollow any accounts they don’t actually know in real life. Frame it as a security cleanup, not a search. Most teens enjoy this once they understand it’s not an inquisition.
Five red flags worth a real conversation
Most of parenting an online kid is just paying attention. The signals worth a calm, non-accusatory check-in:
- Sudden secrecy around a specific app or contact. Different from normal teen privacy — this is panic when you walk in the room.
- A new “friend” nobody at school has met. Especially one your kid talks about a lot but won’t introduce.
- Money missing or new gift cards. Either a scam, an in-app purchase spiral, or both.
- Sleep crashing. Phone in bed, two-hour TikTok holes, mood worse in the morning. Do the kitchen-charger thing.
- A new emotional intensity around an AI app. Talking to a chatbot like a partner, defending it, hiding it.
None of these are proof of anything. All of them are reasons to go for a walk together and ask, gently, how things are going.
If something already went wrong: the first hour
When your kid comes to you, the first job is the sentence: “I’m so glad you told me.” The second is the right next step, and that depends on what happened.
They sent a photo, or someone is threatening to share one
Don’t pay and don’t keep negotiating. Screenshot the account, the messages and any payment demand, then block and report the account in the app. Don’t delete your kid’s account or the chat until the evidence is saved. Report to the NCMEC CyberTipline (CyberTipline.org or 1-800-843-5678) and the FBI (tips.fbi.gov or 1-800-CALL-FBI), and use Take It Down: it creates a digital fingerprint of the image on your own device, so participating platforms can find and remove copies without anyone viewing it.
They lost money, a gift card, or card details
If a debit or credit card was used, call the number on the back now to dispute the charge and replace the card. Gift card money is usually gone once the numbers are shared, but call the card’s company anyway, tell them it was a scam, and ask about a refund. Change the password on any account they logged into from a link, and report it at ReportFraud.ftc.gov. Our first 60 minutes after a scam checklist covers the rest.
Their account got hacked
Use the app’s own account-recovery flow, never a “recovery service” that DMs you. Change the password, turn on two-factor authentication, and sign out of other devices. Then warn their friends: the next move is usually a message to everyone on the list from the hijacked account, asking for codes or money. Watch for “we can get it back” offers that show up afterward. They’re the second scam.
They’re being bullied or harassed
Screenshot, then block and report in the app. Most bullying involves classmates, so the school is usually the right next call. Threats of violence, or anything involving sexual images of a minor, go to the police. Resist the urge to reply on your kid’s behalf; it almost always escalates.
Lectures don’t stick. Drills do.
ScamDrill sends safe, age-appropriate simulated scams by email — fake Roblox alerts, fake Discord verifications, fake “hey it’s me my account got hacked” messages — so kids build pattern recognition before a real scammer reaches them. Teen accounts are included free in every family plan.
Start your family plan →One thing to do this week
Pick one line from the household agreement above and try it for seven days. Most families start with the kitchen-charger rule, because it touches everything else — sleep, mood, late-night DMs, the algorithmic doom-scroll. After a week, pick a second. The goal is a household where, by the time your kid is sixteen, the internet is something you talk about the way you talk about driving: a thing they get to do, that has real risks, that you’ve practiced together.
For more, see our companion guides on teaching kids about online scams without scaring them, running a phishing simulation for your family, and the five scam trends spiking in 2026. For something to put in front of the teenager rather than read about them, we keep a one-page rundown of the scams that reach their DMs. If you have aging parents in the house too, our 2026 playbook for adult children closes the other end of the loop.