Explained
Explore our essential digital safety resources below. Whether you need to understand age verification, manage in-game spending, or decipher the difference between safety and privacy settings, we have broken down the key concepts every parent needs to know.
PEGI ratings are the age labels you see on games: 3, 7, 12, 16 and 18. They tell you the youngest age a game’s content is suitable for, based on things like violence, language and in-game spending. They are not a measure of difficulty, and they say nothing about who your child might meet or chat with online.
HOW IT WORKS
- Ratings are awarded through the PEGI system and administered in the UK by the Games Rating Authority, which reviews content before a game goes on sale.
- The five levels reflect content, not skill: PEGI 3 and 7 cover mild content, PEGI 12 introduces more realistic violence or mild bad language, and PEGI 16 and 18 cover strong violence, sexual content, gambling imagery or drug use.
- Content descriptors sit alongside the age label. Small icons flag the reason for the rating, such as violence, fear, bad language, gambling or in-game purchases, including purchases with random items.
- From June 2026, any newly submitted game containing paid loot boxes or similar random paid items will receive a minimum rating of PEGI 16, reflecting concerns about gambling-style mechanics.
- App store ratings can differ from PEGI because Apple applies its own rating system while Google Play uses an international system that maps to PEGI. The same game can therefore carry different ages on different stores.
- PEGI 12, 16 and 18 ratings are legally enforceable at UK retail. A shop that sells an 18-rated boxed game to a child is breaking the law, though digital stores rely on account settings instead.
WHAT YOU CAN DO
- Check both the age label and the descriptors before agreeing to a game, because a PEGI 12 with in-game purchases raises different questions from a PEGI 12 with violence.
- Set the age limit in your child’s console or app store account so titles above their rating cannot be bought or downloaded without your approval.
- Remember the rating covers official content only. Online chat, user-made levels and mods are not rated, so look at how the game is actually played.
- Play or watch a game together before deciding. Ten minutes of gameplay tells you more than any label.
The two are easy to confuse but do different jobs. Safety settings control who can reach your child: who can message them, comment on their posts, see their profile or invite them into a game. Privacy settings control what the platform itself collects and shares, such as location, browsing habits and personal data.
HOW IT WORKS
- Safety settings answer the question ‘who can contact or see my child?’. They cover direct messages, friend requests, comments, tagging, voice chat and whether a profile is public or private.
- Privacy settings answer the question ‘what does the platform know and share?’. They cover location tracking, ad personalisation, data sharing with other companies and whether activity is visible to others.
- Both usually live in different menus. Safety options often sit under ‘Privacy and safety’ or within account settings, while data controls may hide under ‘Ads’, ‘Data’ or ‘Permissions’.
- Defaults matter enormously. Many platforms now default under-18 accounts to private, but older accounts, or accounts created with a false date of birth, keep adult defaults.
- The two interact: a public profile (a safety choice) combined with location sharing (a privacy choice) can reveal where a child is right now to anyone who looks.
WHAT YOU CAN DO
- Sit down with your child and walk through both menus on each app they use, starting with who can message them and whether their profile is public.
- Turn off precise location access for social apps unless there is a clear reason for it, and check camera roll and contact permissions while you are there.
- Check the date of birth on each account. If it is wrong, the protective defaults for under-18s will not apply.
- Repeat the check after big app updates, since redesigns sometimes reset or relocate settings.
Many popular games are less like a finished film and more like a box of building blocks. Players create their own levels, worlds, game modes and modifications, which means the game your child plays may look nothing like the game that was originally rated. That creativity is wonderful, but it comes with things worth knowing.
HOW IT WORKS
- Mods (modifications) are player-made changes to a game: new characters, maps, rules or graphics. Some are official and curated; others are downloaded from third-party websites.
- Custom servers are privately run online spaces within or alongside a game, common in Minecraft and Discord communities. Each server sets its own rules, its own moderation and its own player base.
- User-generated content (UGC) covers everything players make and share, from Roblox experiences to Fortnite Creative islands. Platforms moderate it, but nobody reviews every creation before children see it.
- PEGI and app store ratings apply to the official game only. A child-friendly base game can host user-made content involving horror, violence or romantic role-play that would rate far higher.
- Unofficial downloads carry real technical risk: fake mods and ‘free currency’ tools are a common route for malware, account theft and scams aimed at young players.
WHAT YOU CAN DO
- Ask what servers, maps or experiences your child actually plays, not just which game. The answer often surprises parents.
- Only download mods from official, in-game stores or well-known community libraries, and never in exchange for account details.
- Use platform settings where they exist, such as Roblox’s content maturity levels, to limit which experiences an account can join.
- If your child runs or joins a private server, ask who else is on it and who moderates it, exactly as you would ask about a party.
Modern games rarely stop asking for money once you have bought them. From surprise-item loot boxes to daily-refreshing shops, many are built around small, frequent purchases that are easy to make and hard to track. None of this makes gaming bad, but it pays to know how the pressure works.
HOW IT WORKS
- Loot boxes and gacha mechanics sell a chance, not an item: you pay real money for a random reward, and the thing you actually want may take many attempts to appear.
- Battle passes and season passes sell a track of rewards unlocked by playing, which creates gentle pressure to play daily so paid content is not ‘wasted’.
- Item shops rotate on timers, with ‘today only’ offers designed to trigger fear of missing out and discourage sleeping on a decision.
- In-game currencies such as V-Bucks and Robux blur real costs: converting pounds into tokens, often in bundles that never quite match prices, makes spending feel abstract.
- Regulators and researchers compare loot boxes to gambling because they share its core loop of paying for an uncertain reward, and from June 2026 newly submitted games containing them will carry a minimum PEGI 16 rating.
- UK industry rules now require spending controls and transparency, but the strongest protections remain the ones parents switch on themselves.
WHAT YOU CAN DO
- Require a password or approval for every purchase in console, phone and platform settings, and never save a card to a child’s own account.
- Use gift cards or a monthly allowance so spending has a visible ceiling your child manages themselves.
- Translate together: work out what a skin or bundle costs in real pounds before buying, so token prices lose their disguise.
- Talk about the tricks by name. Children who can spot a FOMO timer or a gacha odds screen are far harder to manipulate.
- Check bank and app store statements occasionally, and act early if spending is secretive, distressed or escalating.
When your child opens TikTok, YouTube or Instagram, most of what they see was chosen by an algorithm, not by them. ‘For You’-style feeds study every pause, replay and like, then serve more of whatever holds attention. That design is brilliant at entertainment and troubling when the content that holds attention is harmful.
HOW IT WORKS
- Recommender systems track signals such as watch time, rewatches, likes, shares and searches, then predict what will keep each user scrolling.
- The feed learns from behaviour rather than stated interests, so lingering on a video counts as interest even when the viewer felt shocked or upset by it.
- This can create spirals: a young person who pauses on dieting, self-harm or misogynistic content may quickly find their feed saturated with more extreme versions.
- Because every feed is personalised, no parent can see what their child’s version of an app looks like without looking together.
- The UK Online Safety Act places specific children’s duties on platforms, requiring them to assess how their algorithms expose children to harmful content and to configure feeds so under-18s are protected from material promoting suicide, self-harm, eating disorders and similar harms.
- Most major apps now offer feed controls, including ‘not interested’ buttons, keyword filters, feed refresh options and stricter modes for teen accounts.
WHAT YOU CAN DO
- Scroll together occasionally and ask what the app ‘thinks’ your child likes. Their feed is a mirror worth looking into as a pair.
- Show them the controls: marking videos ‘not interested’, filtering keywords and, on some apps, resetting the feed entirely.
- Make sure accounts use the correct date of birth, since the Online Safety Act protections and teen defaults depend on it.
- Watch for mood changes linked to scrolling, and take seriously any comment that their feed keeps showing something upsetting.
- Professionals can use pupils’ descriptions of their feeds as valuable safeguarding intelligence about emerging trends and harms.
Parental controls are the settings that let you manage what children can see, do, buy and download online. They exist at four different levels, and each one covers a gap the others leave open. Used together, they give you a safety net rather than a single lock.
HOW IT WORKS
- Device-level controls, such as Apple Screen Time and Google Family Link, manage the phone, tablet or console itself: app downloads, screen limits, content filters and purchase approvals.
- Network-level controls come from your broadband provider or router and filter what any device on your home Wi-Fi can reach. They stop working the moment a child switches to mobile data or another network.
- Platform account controls live inside services like YouTube, Roblox, Fortnite or Netflix, and shape what that account can watch, who can contact it, and whether it can spend money.
- In-game and in-app settings go one layer deeper, covering things like voice chat, friend requests and whether strangers can join a session.
- Each layer has blind spots. A broadband filter cannot see inside an app, and a device limit cannot stop a friend’s phone, which is why layering matters.ent ages on different stores.
- No combination of controls replaces conversation. Controls buy you time and reduce risk; talking builds the judgement children carry with them everywhere.
WHAT YOU CAN DO
- Start with the device: set up Family Link or Screen Time first, as it gives you the widest coverage with the least effort.
- Switch on your broadband provider’s filters, then add controls inside the specific apps and games your child actually uses.
- Review settings every few months and after every update, because new features often arrive switched on.
- Be honest with your child about what you have set up and why. Controls discovered secretly feel like surveillance; controls explained feel like care.
- Accept that determined teenagers find workarounds. Treat controls as one part of your approach, not the whole of it.
These three tools do different jobs, and knowing which to use when helps children take back control quickly. Muting quietens a problem, blocking removes contact, and reporting asks the platform to take action. For anything serious, there are routes beyond the platform too.
HOW IT WORKS
- Muting hides someone’s posts, comments or messages without them knowing. It is useful for annoying or draining content where confrontation would make things worse.
- Blocking cuts contact both ways: the blocked person can no longer message, follow or usually even find the account. Most platforms do not notify the person who has been blocked.
- Reporting flags an account, message or post to the platform’s moderation team, who can remove content, restrict accounts or ban repeat offenders.
- Blocking or deleting a conversation can erase the evidence a report needs, which is why screenshots come first when something serious has happened.
- For serious concerns, escalate beyond the platform: contact with a suspected groomer goes to CEOP (the National Crime Agency’s child protection command), threats or sexual images involving a child go to the police, and nude images of under-18s online can be removed through Childline and the IWF’s Report Remove tool.
WHAT YOU CAN DO
- Teach the order for serious incidents: screenshot first, then block, then report. Save usernames, dates and messages before anything disappears.
- Practise finding the block and report buttons together on each app while things are calm, so your child is not searching for them in a crisis.
- Make clear your child will never be in trouble for showing you something upsetting. Fear of losing their phone is the main reason young people stay silent.
- Report grooming or sexual approaches to CEOP at ceop.police.uk, and call 999 if a child is in immediate danger.
- Professionals should follow their setting’s safeguarding procedures alongside any platform report, and record what was seen, when and by whom.
A VPN and a private browsing window are two of the most common ways young people slip past filters, and neither is sinister in itself. Adults use both every day for perfectly good reasons. Understanding what they actually do helps you respond calmly rather than assume the worst.
HOW IT WORKS
- A VPN (virtual private network) routes internet traffic through an encrypted tunnel to another server, hiding what sites are visited from the local network and often making the device appear to be in another country.
- Because the home router or school network can no longer see the destination, VPNs bypass broadband filters, school blocks and some age checks tied to UK location.
- Private or incognito browsing does something much smaller: it stops the browser saving history, cookies and logins on that device. It does not hide activity from the network, the school or the websites visited.
- Young people use these tools for many reasons: reaching blocked sites, hiding a search from siblings who share a device, watching content early via another country, or genuine privacy worries.
- Free VPN apps deserve particular caution, since some fund themselves by collecting and selling the very browsing data they claim to protect.
WHAT YOU CAN DO
- Treat a VPN on a child’s device as a conversation starter, not proof of wrongdoing. Ask what it is for before reacting.
- Use device-level controls, such as Screen Time or Family Link restrictions on app installs, since these still apply whatever network tricks are in play.
- Focus on the behaviour filters were protecting against, rather than an escalating battle of blocks and workarounds you will eventually lose.
- Schools should pair technical filtering with monitoring and education, and treat repeated bypassing as a wellbeing question as much as a discipline one.
Live-streaming means broadcasting video in real time, with viewers watching and reacting as it happens. It is hugely popular with young people, both as viewers and as broadcasters. The ‘live’ part is exactly what makes it different from ordinary video, and it changes the risks.
HOW IT WORKS
- Unlike recorded video, a live stream cannot be edited, moderated in advance or taken back. Whatever happens on camera is seen instantly, and viewers can capture it forever.
- Chat runs alongside the stream in real time, so strangers can speak to a young broadcaster directly and immediately, sometimes with requests, dares or grooming approaches.
- Many platforms let viewers send gifts, donations or paid reactions, which can pressure young streamers to perform, escalate or share more to keep an audience generous.
- A stream can reveal more than intended: school uniforms, street names, bedroom details and background conversations all leak information about identity and location.
- Live features are everywhere, not just on Twitch and YouTube. TikTok LIVE, Instagram Live, Kick and even some games offer broadcasting, with different minimum ages, and TikTok requires users to be 18 or over to go live.
WHAT YOU CAN DO
- Know whether your child watches or broadcasts, because the risks differ. Ask to watch a favourite streamer together to understand the appeal.
- If they broadcast, agree ground rules: no identifying details on camera, comment filters on, and an adult aware the stream is happening.
- Check the platform’s minimum age for going live and use its safety tools, such as restricting who can comment or send gifts.
- Talk about gifts and donations early, since money arriving from strangers is a warning sign that deserves gentle but prompt attention.
- Remind children that live means permanent: anyone watching can record, so ‘it was only a moment’ offers no protection.
Age assurance is the umbrella term for the ways online services work out how old a user is, from a simple date-of-birth box to facial scans and ID checks. The methods vary hugely in strength, and UK law now demands much more than a tick box for the riskiest content.
HOW IT WORKS
- Self-declaration is the weakest form: the user simply types a date of birth, and nothing stops a ten-year-old claiming to be eighteen. It remains the default on many sign-up screens.
- Facial age estimation uses a camera and an algorithm to estimate age from a face, usually without identifying the person. It is quick and reasonably accurate but can be fooled and has margins of error around key ages.
- Age verification is the strongest tier, checking hard evidence such as a passport, driving licence, bank record or mobile contract, often through a specialist third-party provider.
- Traditional age gates are weak because they rely on honesty, and a false date of birth does double damage: it lets a child in, then strips away the protections platforms apply to under-18 accounts.
- Since July 2025, the Online Safety Act requires services showing pornography or other ‘primary priority’ harmful content to use highly effective age assurance for UK users, with Ofcom enforcing and fines of up to 10 percent of global turnover.
- No method is perfect. Shared devices, borrowed IDs and VPNs all offer workarounds, which is why age assurance reduces exposure rather than eliminating it.
WHAT YOU CAN DO
- Check the date of birth on your child’s existing accounts, because an honest age unlocks stronger default protections on most major platforms.
- Expect to see face scans or ID checks yourself on some sites, and use them as a natural moment to explain why the checks exist.
- Do not treat age checks as a substitute for filters and conversation, since determined teenagers can still find ways around them.
- Talk about why age limits exist: they reflect content, contact and data risks, not a judgement about how mature your child is.
- Professionals should note that a child accessing age-restricted services is a vulnerability indicator worth exploring, not just a rule broken.