Your Kid's First Smartphone: Hand Down the Phone, Not Your Credit Card

Klaus is a brand-new parent of a fifth grader. New school, new backpack, new class group chat, and since his son would apparently be “the only kid in the entire class” without a phone, Klaus generously handed down his old one. Just like that. Still signed in to his own account. With his credit card on file in the app store.

Three days later, the kid has browsed Dad's photo library, is reading Dad's emails and has stocked up on enough in-game gems to pay for a weekend getaway. Klaus calls it “trust”. His credit card statement calls it something else.

If you're in the same spot: don't panic, all of this can be fixed. This Survival Kit has you covered: real menu paths, no surveillance state, done in one afternoon.

The four building blocks at a glance

A kid's phone isn't a device, it's a project with four building blocks. Tech is the smallest one, because no parental control in the world replaces a proper talk at the kitchen table.

Step zero: clean out the hand-me-down

Passing on an old phone is sustainable, but only if it's actually empty. As long as your own account is signed in, your kid can access your photos, contacts, email and saved passwords. Worse: the device is still trusted for your logins. Verification codes for your account (the exact second layer that's supposed to protect you) now pop up in your kid's bedroom. That's not a kid's phone. That's a master key with games on it.

How to hand over the old device properly

1. Back up and sign out: back up your data first, then sign out. On iPhone, go to Settings > [your name] > Sign Out. This also removes Activation Lock (the anti-theft feature that ties the device to your account). On Android, remove your Google account under Settings in the Accounts section, which has a slightly different name depending on the manufacturer.
2. Reset: on iPhone, Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. On Android, usually Settings > System > Reset options, on Samsung under General management > Reset.
3. Check for updates: make sure the device still receives security updates. A phone without updates is a front door with the key under the mat. If you buy new, the EU has your back: smartphones newly placed on the market since 20 June 2025 must get updates for at least five years after the model stops being sold.

Tech: a child account, not Dad's account

In Germany, you have to be 16 to create your own Apple account or Google account. Below that, your kid's account runs through yours: via Family Sharing on Apple devices, via Google Family Link on Android. That's not red tape for its own sake: age filters, purchase approval and screen time only work if the device knows a kid is using it.

iPhone: Family Sharing and Screen Time

1. Create a child account: on your iPhone, Settings > Family > Add Member > Create Child Account. Enter the real date of birth, because the default settings depend on it.
2. Turn on Ask to Buy: Settings > Family > [child's name] > Ask to Buy. Every download and in-app purchase now needs your approval first. It's on by default for kids under 13, but check anyway.
3. Set up Screen Time: Settings > Family > [name] > Screen Time. You'll find Downtime (phone-free hours, for example at night), App Limits, Communication Limits (who can contact your kid) and Always Allowed (for example calls to you).
4. Set content filters: under Screen Time > Content & Privacy Restrictions you decide which App Store age ratings apply. Apple uses 4+, 9+, 13+, 16+ and 18+, and 9+ is a sensible starting point for a ten-year-old. The same section lets you block adult websites.
5. Check Communication Safety: it blurs nude images on the device itself and shows help resources. It's normally on for child accounts.

Apple likes to rename menus between iOS versions. When in doubt, use the search bar at the top of Settings.

Android: Google Family Link

1. Link the account: install Google Family Link on your phone (available for Android and iPhone). While setting up your kid's phone, create an account for a child, or add your kid's existing account in Family Link. Then confirm parental supervision on your kid's device.
2. Purchase approval: in Family Link, select your kid, then Controls > Google Play > Require approval for. Choose “All content” so even free apps need your OK.
3. Age ratings: in the same section, set the filter level for apps and games. In Germany, the Play Store shows the ratings of USK, Germany's official age rating body (ages 0, 6, 12, 16 and 18).
4. Screen time: set a daily limit and a bedtime in your kid's profile.
5. Web filter: websites can be filtered for Chrome and Google Search, and SafeSearch (the filter for explicit results) is on by default for child accounts.

Depending on the app version, the section is called “Controls” or “Settings”. The logic stays the same.

Basic security for your kid's phone

• Passcode: at least six digits. The code is a family secret, not playground trivia.
• Automatic updates: on iPhone under Settings > General > Software Update > Automatic Updates, on Android under Settings > System or Software update.
• No password reuse: one password per service, stored in the built-in password manager.
• Backup: turn on iCloud Backup or Google backup so the school trip photos survive the first time the phone hits the pavement.
• Device location: turn on Find My on iPhone or Google's Find Hub (formerly Find My Device) so a lost phone can be found again.

Costs: keeping the phone bill off the PTA agenda

In-app purchases and subscription traps

Most cost traps don't look like bills. They look like gems, coins or a battle pass. Kids find it hard to see in-app purchases (purchases inside the app) as real money. Then there are “free trials” that quietly turn into paid subscriptions after a few days. Klaus once signed up for one himself, for an app that puts dog ears on faces. 7.99 euros. Per week. Yes, really.

Ask to Buy or purchase approval from above is your most important safeguard. To check running subscriptions, go to Settings > [name] > Subscriptions on iPhone, or in the Play Store tap your profile picture > Payments & subscriptions > Subscriptions on Android.

Third-party billing block: the underrated off switch

The second way to get charged is the mobile phone bill: so-called third-party services can bill subscriptions directly to the phone number. Since 2019, Germany's telecoms regulator (Bundesnetzagentur) has required a confirmation page from the network operator showing the price, but kids famously tap faster than they read.

The fix is called a third-party billing block (Drittanbietersperre in German). Your mobile carrier has to set it up on request, and the block itself is free. Request it in the customer portal, the carrier's app or by letter (Germany's consumer advice centres, the Verbraucherzentrale, offer a template). Partial blocks exist, but for a kid's phone: block everything, done.

Already charged? Cancel the subscription, dispute the bill with your carrier, ask for a refund. The consumer advice centres can help.

Prepaid or a spending cap

For starters, prepaid is ideal: money that isn't topped up can't be spent. With a contract, ask for a spending cap. And for app purchases: top up an App Store or Google Play balance instead of adding a credit card. Pocket money with a built-in ceiling, basically.

Communication: class chat, WhatsApp and everything else

Minimum age: what the terms say

Since 2024, WhatsApp has required users in the EU to be at least 13, down from 16 before. According to their terms, Instagram, TikTok and Snapchat are also at 13. Usually all it takes is ticking a box, and in many fifth grade classes the class chat runs on WhatsApp anyway. Whether you go along with that is your call. If you do, set it up together, not behind your back. WhatsApp has also announced parent-managed accounts for younger kids that are rolling out gradually, so its help center is worth a look.

Privacy settings in WhatsApp

Under Settings > Privacy, go through these together with your kid:

• Profile photo, About and Status: set to “My contacts”. Strangers don't need to know what your kid looks like.
• Last seen and online: set to “Nobody” or “My contacts”.
• Groups: set to “My contacts” so random numbers can't drop your kid into random groups.
• Calls: turn on “Silence unknown callers”.
• Live location: off, unless you use it deliberately within the family.

Class chat rules that actually help

A class chat is its own little ecosystem: homework, memes, voice messages at 11 pm and the occasional argument that gets out of hand. A few rules worth talking through:

• No photos or videos of others without their permission.
• Don't forward chain letters or scary messages. Ignore them or show them to an adult.
• After an agreed time, the chat goes quiet.
• Nobody gets kicked out of the group to humiliate them.
• If you see something bad, speak up. That's not snitching, that's having someone's back.

Cyberbullying: collect evidence, don't fire back

If your kid is insulted or humiliated in a chat: listen, no blame, then take screenshots that show the name, date and time, block and report the senders and bring the school on board. Threats or blackmail are a matter for the police, and in most German states you can file a report online through the police online reporting portals (Onlinewache). Anonymous help is available from JUUUPORT (online peer counselling by teens for teens) and from Nummer gegen Kummer, Germany's free helpline for kids and parents.

What never gets forwarded

Time for a serious moment. Class chats regularly surface content that can be illegal to own or forward: violent videos, banned extremist symbols or sexual images of children and teenagers. In Germany, criminal liability starts at 14, but the police investigate younger kids' cases too, and phones are often seized. In 2024, lawmakers lowered the minimum sentences for child sexual abuse material again, because parents or teachers had often forwarded it with good intentions. It's still a crime.

The most important rule for you: with sexual images of children, don't take screenshots and don't let anyone send them to you, not even “as evidence”. That would put the material in your possession. Instead: put the phone aside, delete nothing, inform the police and the school's head. This is the one case where the screenshot reflex is wrong.

Cybergrooming: know the red flags

Cybergrooming means adults deliberately building contact with children online in order to sexually abuse them, often via online games with chat features. The patterns tend to be similar:

• A new online contact claims to be the same age and is unusually understanding.
• Lots of compliments, gifts or in-game currency, a lot of closeness very quickly.
• Pressure to switch to a different messenger where they can chat “in private”.
• Being asked not to tell the parents.
• Conversations that are gradually steered towards looks, photos or meeting up.
• Pressure or blackmail once a photo has been sent.

Warning signs in your kid can include withdrawal or secrecy around the phone. The best protection is a relationship in which your kid knows: I won't get in trouble or lose my phone if I tell you something feels off.

If you suspect something: don't blame your kid, don't delete chats or files (but don't forward them either), don't confront the contact yourself and report it to the police. Where to get help in Germany: your local police or the states' police online reporting portals, Nummer gegen Kummer (kids' and teens' helpline 116 111, parents' helpline 0800 111 0 550, both free and anonymous), the national helpline for sexual abuse (Hilfe-Telefon Sexueller Missbrauch, 0800 22 55 530) and jugendschutz.net, Germany's youth protection centre for the internet, where you can report illegal content online.

Rules: an agreement, not a control freak setup

The family media agreement

Tech is the fence. Rules are the house rules. At mediennutzungsvertrag.de, the German online safety initiatives klicksafe and Internet-ABC offer a free generator (in German) that lets you put together a media agreement with your kid, either for ages 6 to 12 or 12 and up. The building blocks cover screen time, phone-free zones and costs. The best part: there are rules for parents too. Yes, Klaus, “no phones at the dinner table” applies to you as well.

Tip: negotiate rather than dictate, and revisit it after a few months. A fifth grader in September isn't the same person by May.

Location sharing: safety or surveillance?

Sharing locations within the family (via Find My on iPhone, via Family Link on Android) can be reassuring, for example on the new route to school. But constant tracking without agreement is surveillance, and it eats away at exactly the trust you need when it comes to cybergrooming. A fair deal, agreed out in the open: location on for the school run and trips, but no check-up calls just because the dot on the map spent three extra minutes at the bakery.

Sharenting: parents overshare too

Sharenting (sharing plus parenting) means parents posting photos and details of their children online. That WhatsApp status with the first-day-of-school photo, school name included, goes out to all your contacts, including the guy who once bought your old sofa.

klicksafe recommends: ask your kid (from around age seven they should have a say, and no means no), no bath or nude photos, preferably no recognisable faces, no hints about school, club or home address. Even harmless everyday photos can be misused with AI tools.

Checklist

• Old account signed out, device reset, update support checked
• Child account set up, purchase approval and age filters on
• Passcode, automatic updates, backup and device location on
• Third-party billing block requested from your carrier
• Prepaid plan or spending cap, no credit card on file
• Talked about class chat, cyberbullying and cybergrooming
• Nummer gegen Kummer (116 111) saved in your kid's contacts
• Media agreement created together
• Location sharing agreed on, not switched on secretly

Bottom line: guide, don't just block

Klaus has cleaned up: his account and credit card are off the kid's phone, the billing block is requested, the media agreement is on the fridge. He has already broken “no phones at the dinner table” twice. His son pointed it out politely, and that's exactly how it's supposed to work.

A smartphone is neither a baby monitor nor an ankle tag. It's a tool that helps your kid learn to move safely online. And while you're at it, set up two-factor sign-in for the most important accounts. Same rule for you and for the kid: Turn on MFA. Think purple.