Privacy, passwords and identity

Start with the free freeze

A child has no reason to look at their own credit, so misuse can go unnoticed for a long time. The FTC's list of warning signs includes a student loan denied because of credit the child did not create.

The FTC's advice is clear: if your child is under 16, request a free credit freeze. You do it by contacting each of the three credit bureaus, Equifax, Experian and TransUnion. The FTC says there is no cost to place or lift a freeze. A freeze stops new credit being opened in your child's name. It only blocks new credit. The FTC's own warning signs, such as benefits denied or an IRS letter, show other ways a child's number can be misused, which is why they matter too. The freeze stays until you ask the bureaus to remove it, so lift it, or lift it temporarily, before your child applies for anything that checks credit, such as a student loan, a first card, or some apartment and job applications. The FTC says lifting a freeze is free.

Teenagers aged 16 and 17 may request and remove a freeze themselves, so this is also a good moment to do it with them. For your own credit, CoverScore has a step-by-step guide: Freeze your credit at all three bureaus.

What misuse looks like

The FTC lists signs worth knowing:

• A call or bill about an account you did not open.
• Government benefits denied because someone is already using your child's Social Security number.
• A letter from the IRS about unpaid income taxes for your child.
• A student loan denied because of credit your child did not create.

If you see one, the FTC says to contact the fraud department of each company involved, ask the bureaus to remove fraudulent accounts, and report it at IdentityTheft.gov.

If a company tells you your child's information was in a breach, the same pages apply: freeze their credit if they are under 16 and watch for the signs above. For your own accounts, CoverScore's first 48 hours after a breach names you lists what to do first.

Your child's accounts: passwords and the second step

CISA and the FTC give the basics, and they apply to a child's accounts as much as yours:

• A different password for every account (CISA), and if one was reused, change it everywhere it appears (FTC).
• A password manager is an option, not a requirement. It creates strong passwords and remembers them for you, and a built-in manager on a phone or browser can do this job.
• Two-factor sign-in where it is offered. The FTC calls security keys the strongest method and says authenticator apps are safer than codes sent by text or email.

Start with the account that resets all the others, which is the email address. If a child has their own email, set it up with them. For the adult accounts in your house, CoverScore's guide to turning on multi-factor authentication where it matters most covers which ones to do first.

What apps may collect about a child

Under the FTC's COPPA rule, which is designed to protect children under 13, an operator must give parents direct notice and get verifiable parental consent before collecting a child's personal information, with limited exceptions. For everything else, the settings on the phone and in each app do more of the work. The parental controls guide and the device guide cover them.

Talking about scams

No tool replaces this one. Tell your child, in words that fit their age, that:

• Anyone who pressures them to act fast, keep a secret or pay is a reason to stop and tell you.
• They will not be in trouble for telling you, even if they already clicked or paid.
• A password or sign-in code is never something to hand to someone who messages them.

Our apps, games and social media guide covers what to do if someone pressures a child for images or money.

Data brokers and people-search sites

People-search sites are a type of data broker. The FTC says you can opt out yourself, one site at a time, for free, or pay a service to do it for you. It also says opting out does not delete your information from public records, and that it could reappear for sale if the records change. That is a reason to treat removal as maintenance, not a one-time fix.

A free privacy score for adults, on a sister site

CoverScore is a separate site from SafeMama. It is built by Pandotic, the company behind SafeMama, and it covers the adult household privacy layer: passwords, breaches, data brokers and credit files. Its free Privacy score is built for adult accounts, not children, and it asks for an email address, so read what it asks for before you use it. CoverScore also sells paid services, and some links on it earn CoverScore a fee. The score itself is free.

What to check before paying for identity protection

Before you pay, ask:

• What does it do that the free freeze does not? Alerts, a family plan, or help with recovery are real features. A freeze is not one of them, because it is free.
• Does it cover children? Check the plan, because not every plan is written for a family.
• What does recovery help look like in practice? Ask what the service will actually do if your child's identity is misused.
• What does it cost after the first year? Check the renewal price, not just the first one.

We do not yet publish a roundup of paid services. When we do, it will start with the freeze and recommend a paid service only for a named feature.