Keeping Kids Safe Online: What We Did Together

Why This Session Mattered

In Canada, children aged 8 to 18 spend an average of more than 7 hours online every day. More than half of children under 12 already own their own smartphone. And 1 in 3 children report having been contacted by a stranger online.

These are not distant statistics. They describe the daily reality of families in our community — including newcomers who are still learning how Canadian digital platforms work, and parents who simply didn't know that the tools to protect their children were already built into every device they own.

That is exactly what this workshop was about: turning those tools on, together, in real time.

What Parents Discovered First

Before we touched a single setting, we asked one question: "Did you know that by default, parental controls on most devices are turned off?"

Most participants did not know. That moment — realizing that every phone shipped to their child came with the door unlocked — is what made the rest of the session land.

A child can, by default, download any app without permission, disable their own location, delete their browser history, and access any website. None of that requires any technical skill. Turning it around does — and that is what we did together.

Block 1 — Parental Controls on Every Device

We demonstrated live configuration on four devices simultaneously: an iPhone 5S, two Android phones (one as the parent device, one as the child), a MacBook, and a Windows PC.

On iPhone (Screen Time):

Participants navigated to Settings → Screen Time and enabled it as a child device. They set a Screen Time passcode — critically, different from the device unlock PIN — and configured App Limits by category (Social Networking, Games, Entertainment). Content & Privacy Restrictions were enabled to limit adult websites, and a Downtime schedule was set from 9 PM to 7 AM, locking the device automatically at bedtime.

On Android (Google Family Link):

The most powerful live moment of the workshop. With both Android phones visible on camera, participants saw the parent phone send a "Lock Device" command — and watched the child phone go dark instantly. No warning, no appeal. That single demonstration showed more than any explanation could. We also walked through app approval: the child phone attempted to install an app, and the request appeared on the parent phone for approval or rejection.

On MacBook:

System Settings → Screen Time mirrors the iPhone experience almost exactly. Participants learned that if Family Sharing is configured, limits set on one Apple device can apply to all devices in the family group — a single dashboard for all Apple products in the home.

On Windows:

The Microsoft Family Safety dashboard at family.microsoft.com provided the richest view of all — weekly activity reports showing exactly which apps were used, which websites were visited, and for how long. Content filters were enabled, age ratings were set for the app store, and screen time schedules were configured day by day.

Block 2 — Content Filters and Safe Browsing

Parental controls manage time. Content filters manage what children actually see. Both are necessary. Neither replaces the other.

YouTube Restricted Mode was enabled on all browsers. Participants learned the key step most miss: locking Restricted Mode, which requires a Google sign-in and prevents children from simply toggling it off. For families with children under 8, YouTube Kids was recommended as a completely separate app with no browsing capability.

Google SafeSearch was locked on the child's account. Without this, a standard Google image search can return explicit results in seconds. With it locked, the padlock icon on google.com confirms the filter is active and cannot be disabled by the child.

DNS Filtering was the most technically impactful step of the evening. On the Windows machine, we changed the DNS server to Cloudflare for Families: 1.1.3.3 (preferred) and 1.0.0.3 (alternate). The effect was immediate — attempting to load a known adult content site returned a block page. Participants were then shown the router-level option: apply the same DNS settings on the home router, and every device on the Wi-Fi network — phones, tablets, smart TVs, gaming consoles — is protected without any per-device configuration.

Block 3 — TikTok, Roblox, and WhatsApp

The three platforms that generate the most concern among parents — and the three that most parents have never opened a settings menu on.

TikTok Family Pairing was demonstrated live using both Android phones. The child's TikTok generated a QR code; the parent's TikTok scanned it. Within 60 seconds, the parent phone had control over the child's daily screen time limit, Restricted Mode (filtering inappropriate content from the feed), and Direct Messages — which were turned off entirely. Strangers can no longer message the child privately.

Roblox privacy settings were configured step by step: who can message the account, who can chat in-game, and who can interact in experiences were all restricted to Friends. Account Restrictions were enabled, locking the account to curated age-appropriate content. A 4-digit Account PIN was set, preventing the child from reverting any of these settings without parental knowledge.

WhatsApp required a different approach — awareness rather than configuration. Participants learned that the minimum age for WhatsApp in Canada is 16. They also learned that archived chats are not deleted — children can hide conversations by swiping left, and those conversations remain fully accessible under "Archived Chats." Privacy settings were reviewed: Last Seen set to Nobody, Profile Photo to My Contacts, and Groups to My Contacts Only. Linked Devices were checked for any unknown sessions.

Block 4 — The Conversation That Matters Most

Every tool we configured that evening can be bypassed by a child who has learned not to tell their parent when something goes wrong online. The most important protection is not a setting — it is trust.

We offered age-specific language for three stages:

For children under 8: "Some things online can be scary or confusing. If you ever see something like that, always come and show me. You will never, ever get in trouble for telling me." Said while setting up parental controls together — making it a team effort, not a punishment.

For children 8 to 12: "If someone online ever asks for your photo, where you live, or what school you go to — even if they seem very nice — you tell me right away. Real friends never ask for that." Said while configuring TikTok and Roblox — linking the why to the settings being changed.

For teenagers 13 to 17: "I trust you. I am not trying to read all your messages. I just want you to know I am here, no judgment, if something goes wrong online. Please come to me first — not last." Said while showing them the activity report — framing monitoring as care, not surveillance.

Warning signs that a child may be targeted online include: becoming secretive about their phone or online activity, receiving unexpected gifts or money, withdrawing from family conversations, or developing relationships with older people they met online. Any of these warrants a calm, open conversation. Suspected exploitation should be reported to cybertip.ca, Canada's national tip line for online child exploitation.

If Something Has Already Happened

This section drew the most questions. Many participants had already experienced something — a child who had seen inappropriate content, an account that had been accessed by someone unknown.

The guiding principle: how you react the first time determines whether your child comes to you the second time.

If a child saw inappropriate content, the first step is to stay calm, ask gently what they saw, and reassure them — "That was wrong content. You did exactly the right thing by telling me." Punishment makes the problem invisible, not smaller.

If personal information was shared, change affected passwords immediately, document what was shared, and contact the platform to request removal.

If a stranger made contact, do not delete the messages — they are evidence. Block the account, then report to cybertip.ca and the local police non-emergency line.

If an account was compromised, sign out of all active sessions, reset the password, enable two-step verification, and review sent messages for what may have been shared.

Tonight's Action Checklist

If you attended the workshop, here is what to do before you go to bed:

• Turn on Screen Time / Family Link / Microsoft Family Safety
• Set a Screen Time passcode that is different from your device unlock PIN
• Enable YouTube Restricted Mode on all browsers in your home
• Lock Google SafeSearch on your child's Google account
• Change your device or router DNS to 1.1.3.3 / 1.0.0.3
• Set up TikTok Family Pairing if TikTok is installed
• Enable Roblox Account Restrictions and set an Account PIN
• Have the conversation with your child tonight — pick the script for their age