The most useful hour you will spend on your child's first phone happens before they ever hold it. A phone that starts out with limits in place feels normal to a kid. A phone that starts wide open and gets restricted after a problem feels like punishment, and that is when the workarounds and secret accounts begin. So set everything up first, with the new phone in one hand and your own in the other.
This guide walks through that setup in order: the account, the app store, permissions, the lock screen, time limits, and the two conversations that matter more than any setting. The steps work for iPhone and Android alike.
One principle guides everything here: the goal is not surveillance, it is a gradual handover. Start with tight controls and loosen them deliberately as your child shows they can handle more. Loosening a rule feels like trust. Tightening one after the fact feels like a fight.
Wipe it, then create a real child account
If the phone is a hand-me-down, erase it completely before doing anything else. On an iPhone, open Settings, tap General, then Transfer or Reset iPhone, then Erase All Content and Settings. On an Android phone, open Settings, tap System, then Reset options, and erase all data. This clears out old accounts, saved passwords, and leftover apps.
Then create a dedicated child account using your child's real birthdate. This is the most consequential choice in the whole setup. Plenty of parents enter an adult birthdate to skip a little friction, and doing so quietly strips away every protection the phone would otherwise apply: content filters default to off and purchase approvals never trigger. The phone treats the user as an adult because you told it to.
On an iPhone, open Settings, tap your name at the top, choose Family Sharing, then Add Member, then Create Child Account. On an Android phone, open Settings, tap Digital Wellbeing and parental controls, and follow the steps to create a child account linked to your own. Either way, the child's account joins your family group, which is what makes every control in the rest of this guide possible.
Make every download go through you
The single control with the biggest payoff is download approval. When it is on, every app your child tries to install, free or paid, sends a request to your phone, and nothing lands until you say yes.
On an iPhone this is called Ask to Buy. It is usually on by default for younger children in a family group, but confirm it: open Settings, tap Family, choose your child's name, and check that Ask to Buy is turned on. On an Android phone, the parental control settings for the child account let you require approval for downloads and set a content rating ceiling for apps and games.
Approvals matter for a reason that has nothing to do with money. Any app with a chat feature is a messaging app, no matter what the store page calls it. Drawing apps, games, and virtual pet apps have all shipped with open chat rooms attached. An approval request gives you a moment to check, before the app is on the phone, whether it lets strangers talk to your child.
While you are in those menus, require a password for every purchase; in-app buying is engineered to be impulsive, and children are the least equipped audience to resist it.
Go through app permissions together
Once the first few apps are installed, sit down together and review what each one can reach. On an iPhone, open Settings and tap Privacy and Security. On an Android phone, open Settings, tap Privacy, then Permission manager. The rule to teach is simple: an app gets only the access it clearly needs to do its job. A drawing app does not need your child's contacts. A single-player game does not need the microphone.
Location deserves special care. For most apps, set location access to While Using the App or to Never, and turn off precise location for anything that only needs a general area. The only app that should know exactly where your child stands is the family locator you set up yourself.
Teach the default answer, too: when an app asks for something mid-game, tap Don't Allow and come ask. Permission can always be granted later if the app genuinely stops working. Our guide to app permissions covers which requests are reasonable and which are red flags.
Passcode, lock screen, and a phone you can find
Set a six-digit passcode together and make it random: not a birthday, not a house number. Fingerprint or face recognition on top of it is fine and makes daily use easier. The house rule that comes with it: you know the passcode too, for now. That is a condition of having the phone at this age, and one you can retire as your child gets older.
Two more settings are worth the minute they take. First, hide message previews on the lock screen: on an iPhone, open Settings, tap Notifications, then Show Previews, and choose the option that hides previews until the phone is open. Second, turn on the phone-finding feature: on an iPhone, open Settings, tap your child's name, then Find My; on an Android phone, look under Settings, then Security. A first phone will be left on a bus eventually. This setting turns that day from a crisis into an errand.
Finally, turn on automatic software updates, and protect the new account itself with a long, unique password from our free password generator, stored in your own password manager, since you are the one managing the account.
Set time limits and content filters on day one
Time limits added months later are a negotiation. Time limits present from day one are just how the phone works, so set them before the first evening with it.
On an iPhone, open Settings and tap Screen Time. Set Downtime for the overnight hours, starting at least an hour before bedtime, add App Limits for games and video, then open Content and Privacy Restrictions to set age ratings for apps and to limit adult websites under Web Content. On an Android phone, the parental control settings offer the same tools: a daily limit, a bedtime schedule, per-app timers, and filters for the browser and search results.
Pick limits you are actually willing to defend. A generous limit enforced every day beats a strict one you keep overriding, because every override teaches that the limit is negotiable. Also allow calls with parents during downtime, so the phone can always reach you.
Have the scam talk before the first strange text
Children receive the same scam messages adults do: fake package deliveries, fake prize notifications, warnings that an account will be deleted unless they act now. They also get versions aimed squarely at kids, especially offers of free game currency or rare in-game items in exchange for logging in somewhere.
Give them one rule and keep it simple: never act on the message itself. Do not tap the link, do not reply, do not type a password anywhere the message sent you. Bring the phone to a parent instead. Kids follow rules with clear lines far better than they follow vague warnings to be careful online.
Pair the rule with a promise: showing you something will never get them in trouble, even if they already tapped the link, even if what they saw was something they should not have seen. The moment a child starts hiding mistakes, every safety setting on the phone matters less. For a preview of the tricks they will face, our guide to phishing and how to spot it covers the exact playbook scammers use, and it works word for word on kids.
Be honest about what you can see
Whatever monitoring you decide on, tell your child exactly what it covers. Secret monitoring almost always gets discovered, and when it does, the lesson your child takes away is that privacy is something to win back through better hiding.
A weekly ten-minute review works well for most families. Sit together and look at the screen time report, the week's app requests, and any new contacts. Reviewing the phone with your child lands very differently from searching it behind their back.
If you use location sharing, consider making it mutual, so they can see where you are too. That reframes it as a family tool instead of a leash. And plan to revisit every setting on a schedule, such as each birthday: loosen a limit, retire a control, hand over a little more of the phone.
Your first-week checklist
Do the first three before you hand the phone over. The rest can wait a few days, but not longer than a week.
- Factory reset any hand-me-down phone, then create a child account with your child's real birthdate.
- Turn on download and purchase approvals, and set a content rating ceiling for apps.
- Set a random six-digit passcode you both know, hide lock screen previews, and turn on the phone-finding feature.
- Set downtime, app limits, and web filters in Screen Time or the parental control settings.
- Review permissions on the first apps together, with location set to While Using or Never.
- Have the scam talk: never act on the message, always bring it to a parent, no blame either way.
- Agree on the ground rules out loud, including where the phone charges at night (outside the bedroom) and when you will revisit the limits together.
