A birthday post is one of the most ordinary things a parent shares. There’s a photo of the cake with your child’s name in frosting, a caption mentioning the party at the trampoline park, and a school T-shirt in the background. Nothing about it feels risky, and for most families it isn’t.
But this is a good example of how a child’s personal information ends up online. The American Psychological Association notes that a school logo in the background, a house number on a mailbox, or a geotag in a photo’s metadata can leave a trail parents don’t anticipate. A federal family privacy guide from the Administration for Children and Families suggests asking before you post whether it could reveal where your child lives, goes to school, or spends time. Some of the places kids’ information travels are in a parent’s hands, which makes them a good place to start.
You’re right to care about your child’s data. Here’s where to focus first, what deserves a little less worry (but still a question or two), and three things to do this week.
Worry More
- What we post ourselves. In a study of 493 U.S. parents of young children, researchers found that most social media-active parents share photos of their kids and feel comfortable doing it without the child’s permission. As the APA’s 2026 review summarizes it, the same study found that frequent sharers tend to have followers they don’t know personally and often underestimate risks like photo misuse by strangers.
- Social media, games and “free” apps. An FTC staff report on nine major social media and video streaming companies said they engaged in “vast surveillance of consumers in order to monetize their personal information” and often treated teens the same as adults. Games count too. The FTC alleged that Fortnite’s maker collected data from kids under 13 without parental consent and turned on voice and text chat by default. Epic agreed to pay $275 million, the largest penalty the FTC says it has ever obtained for violating one of its rules.
The FTC’s updated children’s privacy rule now requires covered apps to get a parent’s separate opt-in before sharing a child’s data with third parties for targeted advertising. But the rule covers apps directed to kids under 13 and apps with actual knowledge that a user is under 13, so the age entered at sign-up matters.
- Child identity theft. Javelin Strategy & Research’s 2022 survey of 5,000 households estimated that 915,000 U.S. children were victims of identity fraud in a year, with families spending an average of 16 hours resolving it. The FTC notes that a child under 18 generally has no credit report, and lists warning signs like collection calls about accounts you never opened or a denied student loan.
Worry Less
- “My phone is listening to us.” In 2026, the FTC announced settlements with Cox Media Group and two marketing firms over an “Active Listening” service pitched as targeting ads based on conversations captured from smart devices. The FTC alleged the service didn’t use voice data at all. It resold email lists from other data brokers. The agency finalized the orders in August. That’s one product, not a verdict on every app, so keep microphone permissions limited to apps that need them.
- The learning programs your school assigns. School vendors have had real breaches. The FTC finalized an order against Illuminate Education after a breach of 10.1 million students’ data, and Texas sued PowerSchool over its 2024 breach. Breaches hit every sector, though. North Carolina logged 2,258 reports from businesses, hospitals, government agencies and others in 2024, the most in its history. A Congressional Research Service report updated in June 2026 says providers that receive student records under FERPA’s school official exception may use them only for the purpose the school disclosed them, which keeps vendors from selling the data or reusing it.
- Your pediatrician’s patient portal. Doctors, health plans, and the vendors that work for them are generally covered by HIPAA, which sets privacy, security and breach-notification rules for health information. If you want extra peace of mind, ask the office who can see your child’s portal account and what security options it offers.
Three things to do this week
- Audit your posts. Make accounts private, take down posts that show a full name, birthday, school or uniform, and strip location tags from photos.
- Set up accounts together. Walk through location, chat, and ad settings in each game and app. Be honest about your child’s age, since the under-13 protections depend on the app knowing it, and keep the full birthdate out of public view.
- Freeze your child’s credit. If your child is under 16, the FTC says a credit freeze is free, and it links to the instructions for each of the three bureaus.
Where to put your attention
Most of what shapes a child’s digital footprint gets decided in ordinary moments like a photo posted, an account created, a setting left on its default. Those are the choices a parent controls, and they’re where a little effort goes the furthest.
The rest comes down to asking good questions and expecting clear answers, whether you’re talking to an app, a school, or a doctor’s office. You don’t need to track every headline or give up every screen. Start with the steps above, then revisit them as your child gets older and their online life grows.