Raising Responsible Digital Citizens: Navigating Online Safety

If your eleven-year-old has a phone in May 2026, she is probably not on Facebook and she is probably not on Twitter. She is almost certainly on a group DM on Discord, on Snapchat with a small ring of friends, on YouTube and TikTok much more than the parental-controls report admits, on Roblox if she is on the younger end of that bracket, and — this is the part the standing safety brochures still do not always mention — using a generative-AI tool. About 70% of US teens have already used one. The conversation about raising digital citizens has changed, and most of what is on the first page of Google about it was written before that change.

This article is a working playbook from someone who has spent the last decade reading the platforms teens actually use rather than the ones the brochures imagine they are on. It covers what digital citizenship for kids means at home in 2026, the AAP's new 5 Cs screen-time framework (the strict daily-hour cap is mostly gone), age-bracketed scripts you can use this week, the AI-sextortion advisory the FBI re-issued for Safer Internet Day in February, the new AI-deepfake-nude problem that has reached US middle schools, your child's digital footprint and why it sticks, how the COPPA-13 age floor actually works in practice, a fifteen-minute walk-through of the parental controls you have on the devices already in the house, and a pointer to the AAP's Family Media Plan tool at the end. The mindset behind these rules — guilt, balance, when good enough is good enough — lives in the companion piece on realistic parenting in the digital age. This article is the rules and the scripts.

A note on what this article is and is not. I am a digital-safety researcher and a parent, not a clinician or a law-enforcement officer. The clinical and legal calls in this article — sextortion response, the deepfake-of-your-child situation, suicide and self-harm risk — are reported from named institutional sources (FBI, NCMEC, AAP, Thorn, IWF, UNICEF). When the situation is acute, the right next call is the NCMEC CyberTipline at CyberTipline.org, 911 for immediate danger, and the 988 Suicide and Crisis Lifeline for mental-health crises. Those phone numbers are the YMYL line of this article. Read accordingly.

What digital citizenship actually means at home in 2026

The standard definition of digital citizenship — the ability to use technology responsibly and ethically — does not survive contact with what an actual eleven-year-old does on a Tuesday afternoon. The 2026 version is more specific. Digital citizenship at home, in 2026, means four overlapping competencies your child needs and that you, as the parent, are going to model and scaffold whether you feel qualified to or not. They are: a basic understanding of what platforms technically allow (the rules and the gaps); a habit of reading what is in front of them with skepticism (especially AI-generated text, images, and now voice); a clear set of rules about how they treat other people online and in group chats; and a sense — this is the new one — of what footprint they are leaving and who, eventually, will be able to read it.

The cultural backdrop matters here, and most parent-facing safety content has not caught up to it. NCMEC's CyberTipline received 21.3 million reports in 2025, including 1.4 million reports of online enticement — a 156% increase over 2024 — and more than 1.5 million reports with a generative-AI nexus. The Internet Watch Foundation identified 3,443 AI-generated child sexual abuse videos in 2025 versus 13 in 2024 — a 26,385% increase, driven by open-source image-generation tools that did not exist eighteen months ago. A UNICEF, ECPAT, and INTERPOL eleven-country study found that 1.2 million children had disclosed, in the past year, that someone had turned their image into sexually explicit deepfakes. This is the conversation parents are mostly hearing about in panicked Facebook posts and then ignoring; it is the conversation that has actually changed the brief.

What follows is not a panic and is not a complacency. It is the operating manual.

Loading image...

Screens, the AAP's new 5 Cs, and the Family Media Plan

The American Academy of Pediatrics changed its screen-time guidance in early 2026, and most parenting articles you will find online are still quoting the old version. The new framework — published in the AAP's 2026 "Digital Ecosystems, Children, and Adolescents" policy statement in Pediatrics and summarized in the AAP Center of Excellence on Social Media's screen-time guidance — is built around what the AAP now calls the 5 Cs.

The five Cs are: Child (the specific developmental stage of the specific kid in your house, not an average), Content (the quality of what is on the screen), Calm (whether the screen supports or undermines self-regulation), Crowding-out (whether the screen is displacing sleep, family time, physical activity, or unstructured play), and Communication (whether the family is talking about it). The old "one hour for ages 2–5" cap still applies for the youngest brackets — no screens before 18 months except video-chat with grandparents, ≤1 hour of high-quality content for ages 2–5 — but from age 6 upward, the AAP explicitly says there is no single daily-minute number that applies to every child. The framework is the 5 Cs plus a written Family Media Plan, both of which exist as a free tool at HealthyChildren.org.

The practical translation, in three sentences. For under-fives, hold the old line; the developmental case is strong and the cost is low. For school-age children, run the 5 Cs in your head whenever a screen is in the room — what is it, what is it crowding out, are we talking about it. For teens, give up on the daily hour and bargain on the crowding-out question instead — sleep, school, in-person time, and bedrooms-without-phones-at-night are the four levers worth holding.

What to actually say at each age

The single biggest gap across the institutional online-safety pages I have read — and I have read most of them — is that nobody gives you the sentences. Below are the sentences. Adapt them to your child's name and your own register.

Ages 5–8

The work at this age is mostly about who they are with, not what app they are on. They should not be on social media at all, and if they are on YouTube Kids or Roblox, they are on it with you in the room or on a screen you can see from where you are sitting.

When something on the screen upsets them: "Tell me what you saw. I'm not going to be angry. I want to know what got into your head so we can figure out what to do next." Believe the answer. Do not narrate your reaction. The script that has earned its place in our house, at the end of any device session at this age: "You can always tell me. There is nothing you could see or do online that would make me too mad to help you." That sentence is the thing they need to hear before the thing happens, not after.

When they ask why they can't have an account on the app a friend is on: "That app says you have to be thirteen, and you're not. We'll revisit it when you are." This is the COPPA-13 conversation, in age-five language; it is the same conversation you will be having at age twelve and a half about Instagram. Hold the line gently and consistently — the rule is not yours, and you are not the only family with it.

Ages 9–12

This is the band where most US kids get their first phone, often around age ten or eleven, and where the gap between what parental controls technically do and what is actually happening on the device opens up. The script work shifts to the group chat.

When you ask what is going on in the group chat and they say "nothing": assume that is not the whole story and ask the question one layer down. "OK — who's in it? Is there anybody in it you don't know in person?" The follow-up matters more than the answer. The number you want to know is the size of the group and whether there are strangers in it.

When they show you a video and you cannot tell whether it is real or AI-generated: say so. "I can't actually tell whether that's real. Let me show you what I look at to figure it out." Then look at it together — the lighting on the face, the texture of the hair, the way the hands sit, whether the audio matches the mouth. Modeling skepticism at this age is more valuable than every parental-control setting combined. Generative AI is not going away. The ability to ask "is this real?" before reacting is the literacy.

When something has happened — a mean comment, an image they regret, a stranger DM — the script is short: "Show me. We'll figure out what to do together. You're not in trouble." The "you're not in trouble" sentence is the one that determines whether you ever hear about the next one.

Ages 13–17

By this age the rules they obey are mostly the rules they have internalized. The script work becomes about the rare moments when they come to you and the very rare moments when something is genuinely wrong. Lead with availability.

When they ask whether you saw a TikTok about a sextortion case: this is not a small-talk moment. "I read about it too. Here's what I want you to know — if anything like that ever happens to you, I am the first call. We do not pay. We do not delete anything. We get help. I love you and I mean it." That sentence does several pieces of work; the most important one is the "I am the first call" framing. Statistically (more on that below) some version of this is going to be on the table at some point in the next four years. Set the script before it is.

When they want their phone in their bedroom at night: hold the line. The single highest-yield rule at this age is no phones in bedrooms after a fixed time. The research on adolescent sleep is unambiguous; the research on the 11pm group-chat fight is the texture you do not need.

When you find out about something they did not tell you: do not lead with discovery. "I know you didn't tell me. I think I get why. I'd like to understand what happened and figure out where to go from here. I'm not going to take the phone today." The deal is information for restraint, on your side; if you take the phone, you have closed the channel.

AI sextortion and the FBI 2026 advisory

I want to write this section carefully, because it is the section the rest of the article is built around. In February 2026, the FBI publicly re-warned parents about the surge in financial sextortion targeting minors. The pattern, per the FBI advisory and Thorn's 2025 research, is consistent: a perpetrator (often overseas, often organized) poses as a young woman on Instagram, Snapchat, or another platform; engages a teenage boy in flirtation; obtains an explicit image; and within minutes demands money or gift cards under threat of sending the image to friends, family, and school contacts. Financial sextortion reports to NCMEC climbed from 13,842 in the first half of 2024 to 23,593 in the first half of 2025. NCMEC is aware of at least 36 teenage boys who have died by suicide since 2021 after being victimized in this way. Thorn's 2025 data finds that 13% of sextortion victims were extorted using AI-generated deepfake nudes — meaning the perpetrator did not need a real image to begin the threat — and that one in seven victims were driven to self-harm.

The response, if it happens to your child, is four steps and they are the same four steps every law-enforcement and child-protection source converges on. Stop responding. Do not engage. Do not pay. Paying does not end the threat; it confirms compliance and accelerates the demand. Block the account on every platform where it has contacted you. Save the evidence. Screenshots, usernames, profile URLs, the threats themselves. Do not delete the original conversation. Report to the NCMEC CyberTipline at CyberTipline.org — they will work with law enforcement and with the platform — and call your local FBI field office if you want a direct law-enforcement contact. If your child is in acute mental-health crisis at any point, the 988 Suicide and Crisis Lifeline is available by call or text twenty-four hours a day. If they are in immediate danger, dial 911.

The sentence I would like every parent of a teenage boy to say out loud, in advance, is the one in the teen-script section above: "If anything like this ever happens to you, I am the first call. We do not pay. We do not delete. We get help." It is not a guaranteed prevention. It is the script that has, in named cases, kept the next twenty minutes from being fatal.

Loading image...

AI deepfake nudes of classmates

A separate paragraph because the situation has reached US middle schools and the institutional safety pages are still catching up. Open-source image-generation tools released in 2024 made it technically trivial to turn a small set of normal photos — a handful of selfies scraped from a public Instagram, a short session of compute on a consumer-grade machine — into a realistic deepfake of any specific child. Multiple US school districts dealt with deepfake-nude incidents involving named middle-school students through 2025; the UNICEF/ECPAT/INTERPOL eleven-country study found 1.2 million affected children in the previous year. The TAKE IT DOWN Act, passed in 2025, requires platforms to remove non-consensual intimate imagery (including AI-generated content) within a defined window when reported by the depicted person.

The practical move if your child is the depicted person: report through the platform's non-consensual-imagery channel (every major platform now has one), file a CyberTipline report at CyberTipline.org, save evidence without resharing the image, and tell the school in writing if other students in the school are circulating it. If your child is the one who created the image of a classmate: this is not a prank, and it is a felony in a growing list of US jurisdictions. The conversation is short and serious. The child needs a lawyer.

Real-time voice deepfakes in games and Discord

A short warning, because the threat is new enough that most parental-control software cannot detect it. Real-time voice-cloning models can now be used inside multiplayer-game voice chat and Discord voice channels to impersonate a child the age of your child — a peer, a friend's older sibling, a "girl from the other server." The technique is being used to seed grooming conversations that would have read as creepy in adult-male text but reads as harmless in a familiar-sounding voice. The TAKE IT DOWN Act focuses on published visual content and does not address real-time voice impersonation. The practical move: in voice chat with anyone your child has not met in person, the rule is short — no voice chat with strangers, ever. This is the same rule that always made sense; the new threat just makes it less optional.

Cyberbullying: scripts and platform-by-platform reporting

The cyberbullying problem in 2026 is less new than the sextortion and deepfake problems, and the response is well-mapped. The framework I would use at home is borrowed from stopbullying.gov's Stop-Walk-Talk model adapted into prevention-side scripts your child can hold in advance.

Prevention scripts your child can use: "That's not okay. Stop." Said directly to the person doing it, or said in the chat. "I'm leaving this chat. I'll see you Monday." Said and then done; leaving without explaining buys most of the social distance. "I don't engage with this stuff." Said about a screenshot or a piece of content rather than about a person. "I'm going to tell my parent. I know that sounds babyish; I don't care." Said in advance, internalized as the not-actually-babyish move it is. "Block." Said as a default — and acted on — for anyone the child does not personally know.

Response scripts you can use as the parent: "Show me everything. We're going to save it before we do anything else." Save first, react second. "I'm going to message the school today. I'll keep you in the loop on what they say. You don't have to do anything yet." Take the burden off the child. "We're going to report this on the platform too — let me show you how." Use the platform-specific reporting routes. On TikTok, Report → Safety Center. On Discord, in-app block plus Trust & Safety report at dis.gd/request. On Roblox, the Report Abuse flag on the user or content. On Snapchat, press-and-hold on the snap → Report Snap. On Instagram, the Report → Bullying or Harassment flow. None of these are perfect; all of them generate an actual record, which matters.

The clinical line: if cyberbullying is producing sleep disruption, school avoidance, withdrawal from previously enjoyed activities, or any expression of self-harm, the next call is your pediatrician and, in an acute moment, the 988 Suicide and Crisis Lifeline.

Your child's digital footprint

A short, separate H2 because this is the one most parents underweight. Your child's digital footprint is the sum of everything they have ever posted, everything anyone else has posted with their image, every account they signed up for and forgot, every comment under a friend's photo, and — newly — every prompt they have typed into a generative-AI tool. The first three categories are recoverable, partially; the fourth is not.

The honest framing is that the platforms are durable and the audiences shift. The kindergarten photo your sister-in-law posted to a friends-locked Instagram years ago is in the same database as everything else; the privacy setting is a curtain, not a wall. The middle-school account your child created at age nine and abandoned at age eleven is still indexable by name. The college admissions officer reading her materials a decade from now has access to tools your eight-year-old does not yet know exist.

The practical move is small and unglamorous. Once a year, sit with your child and search their own name and their three closest variations (with last name + town, first name + school). Look at what comes up. Take down what you can. This is the only privacy hygiene that survives contact with the actual digital footprint your child is leaving, and it is the only one most families never do.

Social media and your 13–17-year-old: COPPA, KOSA, and the under-13 account question

The age-13 floor on most major social platforms is not arbitrary; it is the consequence of the US Children's Online Privacy Protection Act of 1998 (COPPA), which restricts data collection from children under 13. Instagram, TikTok, Snapchat, Discord, X, and most other major platforms set their account age floor at 13 to stay out of COPPA scope. Many children lie about their age to sign up earlier — the platforms know this and have been formally pressed about it for years.

The federal landscape in 2026 is unsettled. The Kids Online Safety Act (KOSA), S.1748, was reintroduced in May 2025 in the 119th Congress; in March 2026 the Senate passed a related kids' online-safety bill by unanimous consent, extending data-protection coverage up to age 17. A House subcommittee advanced the broader KIDS Act (H.R.7757), which folds KOSA-style duties with AI-chatbot-for-minors provisions, but House Republicans stripped KOSA's strongest enforcement language. The clean read in 2026: the federal floor is still COPPA-13, the federal ceiling is contested, and the protections that will actually arrive — and when — are not yet knowable. Until they do, the parental work is at the device and the conversation, not at the policy.

What to do when you find an under-13 account on your kid's phone is the question the safety brochures avoid. The answer that holds up in practice is short: do not punish them out of the platform — talk them through deleting the account themselves; talk to them about why the rule exists; and, if they care about the social-graph reasons (their friends are on it, the school group is on it), help them find the version of the platform that actually fits their age (e.g., Messenger Kids, the YouTube Kids app, a non-social texting plan). The penal version of this conversation, in my experience, creates a second secret account. The conversational version creates a foundation you will use again at age fifteen.

Parental controls in 15 minutes

A pragmatic walk-through, because controls are a floor, not a ceiling, and the parents who tell me their controls are "all set up" usually mean they did one thing on one device five years ago.

On the iPhone, the relevant setting is Screen Time, under Settings → Screen Time. Set the daily content category limits (Social, Entertainment, Games) at age-appropriate windows; enable Communication Limits; enable Content & Privacy Restrictions, particularly Web Content (Limit Adult Websites) and App Store age ratings. On Android, the equivalent is Family Link — a separate app, set up on both the parent and child device, with the same content-limit and screen-time features. On the home Wi-Fi router, every modern router has parental controls that can pause the internet for a specific device at bedtime; spend ten minutes finding yours. On the consoles — PlayStation Family, Xbox Family Settings, Nintendo Switch Parental Controls — the controls are good and chronically underused.

What controls do not buy you: visibility into what is being said inside a Discord DM, the content of a Snapchat (disappearing-message platforms genuinely do not retain content), or the ability to see a second account your child set up on a friend's borrowed device. They buy you a floor. The ceiling is the conversation.

One concrete thing to try tonight

If you have read this far and want the one move worth making tonight: open the AAP's free Family Media Plan tool at HealthyChildren.org, spend fifteen minutes on it with your child in the room, and write down three rules and one shared phrase you will both use when the rule breaks. Print it. Stick it on the fridge. Revisit it in three months.

The mindset that holds all of this — guilt, balance, when good enough is good enough — is the companion essay on realistic parenting in the digital age. What you have just read is the rules. That one is the temperament for living with them.