The 10-minute version
Five taps — about 2 minutes each
Five settings that cover the most important part. Each takes a couple of minutes. If this is all you manage today, that's genuinely enough — the rest will be here when you have time.
1. Instagram to private. One switch cuts off most stranger, search-engine and AI access in one go. Not bulletproof — screenshots and old copies are later stations — but it's the single biggest step. How.
2. Facebook "Limit past posts." One button re-locks years of old public posts.
3. WhatsApp profile photo to "My contacts." Right now it's probably a family photo, visible to any stranger who has your number. Lovely.
4. Instagram "Sharing and reuse" off. Stops others using your posts in their creations and AI features.
5. A Google Alert for each child's full name in quotes. A clean name is the cheapest alarm in the world — any hit is a signal.
One login, all of Instagram
About 10 minutes
Open Instagram once and do the lot. The first two are the same ticks as the 10-minute version — if you did those, they're already green here.
Account to private. One switch cuts off most stranger, search-engine and AI access in one go. Not bulletproof — screenshots and old copies have their own stations — but it's the single biggest step. How. Keeping a public account for work? Keep the children off it entirely.
"Sharing and reuse" off — the toggle called "Allow people to reuse your content on Instagram and with AI features at Meta"; switch off both Posts and Reels. Fair warning: this one is genuinely hard to find, the wording varies by app version, and it's still rolling out (US first) — so if it isn't on your account yet, that's normal. If your account is private, you're already covered — tick this and check again after the next app update.
Stop stories being reshared and messages forwarded beyond your followers.
Review your story Highlights. Highlights aren't archived — on a public profile they're published indefinitely. Keep the ones you'd show a stranger; retire the rest.
Old posts and the story archive. Instagram has been auto-saving every story since forever, so the stories from birth are still there. Archive hides from everyone (Meta still keeps it); delete removes it from Meta's servers (backups purge within about 90 days). Download your copy first — the button lives in the Facebook station below.
One login, all of Facebook & Meta
About 15 minutes
Everything Meta-wide lives here too — the download button covers Instagram as well.
"Limit past posts." One button re-locks years of old public posts.
Run the Privacy Checkup end to end — who sees future posts, your friends list, who can look you up.
Audit the two always-public albums: profile pictures and cover photos. "Limit past posts" does not touch them — a decade of family shots often sits there in full public view.
Download your information first — the complete archive of posts, stories and photos onto your own drive, before you delete anything from Meta's. Covers Facebook and Instagram.
Then clean the backlog in bulk. Keep archived (hidden, still stored) or delete (removed; backups purge in ~90 days).
Camera-roll cloud processing off — otherwise unposted photos from your phone can be uploaded for AI suggestions.
In the EU: object to your information being used for Meta's AI via the Meta Privacy Center.
One login, all of Google & YouTube
About 10 minutes
The quiet one — most families have more child photos in Google's cloud than on any social feed.
Audit shared albums and kill old share links — a link forwarded once is public to anyone holding it. How sharing works.
Partner sharing: check whether it's on and with whom. It shares new photos automatically, forever, until switched off — a classic forgotten leak after a breakup or an old device handover.
YouTube family videos to Unlisted or Private, never Public — school performances and birthday videos are fully indexed when public.
One login, all of WhatsApp
5 minutes
Two minutes of settings, one fact about backups most people never learn.
Profile photo, status and "last seen" to My contacts. Right now the photo is probably a family shot, visible to any stranger who has your number (guides at faq.whatsapp.com).
One login, all of TikTok
3 minutes
Short and sweet.
Account to private and "Suggest your account to others" off — see TikTok's account & privacy guide.
Your phone and the Apple cloud
10 minutes
If it's on your phone, it's probably also somewhere else. Private cloud storage isn't public posting — but "in the cloud" doesn't mean "only you."
iPhone families: review iCloud Shared Albums — who's in each one, and whether the "Public Website" switch is on. That switch turns a family album into an open webpage anyone with the link can view.
Camera location capture off, so photos shared by email or small websites don't carry GPS coordinates inside the file.
The deletion truth: deleting from your phone doesn't delete shared copies. Anything you remove also needs checking in Recently Deleted and in any shared album it was added to.
The family agreement
One conversation this week, then it runs itself
Settings protect your accounts; agreements protect your child across everyone else's. A family is only as private as its most enthusiastic relative. You know exactly who I mean.
The names rule: children's names never appear in public captions or comments — from anyone. Faces are hard to control; names are a pure choice, and names are what makes everything else searchable. "My sunshine girls" is fine forever.
The dates rule: no ages, birth dates, or "she's turning 5 today!" in public. Birthday posts are the anchor from which age, school year and year of birth are computed.
The place rule: no school names, uniforms with visible logos, or posting from a location while still there. Post later — same memories, no live trail.
The grandparents round: sit with each posting relative once, share these rules kindly — it's about protecting the grandchildren, not a performance review of grandma — and help make their account private while you're there.
The class-chat ask: one message to the class or team group: "please don't post the kids publicly — happy for the private album." Most parents simply haven't thought about it, and one parent saying it changes the group's default.
The postcard rule: never put children's names, school, or routines into AI chat assistants inside social apps — treat those chats as postcards, not diaries.
Search results, caches and old copies
30 minutes, then patience — removals take days to weeks
Editing or deleting a post changes the original — not the copies. Search caches keep serving the old version until told otherwise, and archives keep dated snapshots on purpose. Deleting something and assuming it's gone is the internet's oldest practical joke.
Search your own name, and each child's full name, in quotes, in a private browser window. This is your baseline — most families find something they'd forgotten.
For changed or deleted pages still showing old text: Google's refresh tool and Bing's removal tool.
Run Google's "Results about you" for family names and request removal of eligible results.
In the EU: for outdated or no-longer-relevant results, file a delisting request via Google's report content portal. Requests about children carry extra weight.
Check web.archive.org for old profiles and blogs; for snapshots exposing your children, email removal requests with exact URLs to info@archive.org.
In the US: people-search sites likely list addresses and "associated persons." Start with Whitepages and Spokeo; the long tail shrinks after the big ones.
Other people's cameras and websites
Two emails this month
Much of a child's public footprint isn't your doing at all: school galleries, club websites, newsletters, results pages with full names. In the EU they need your consent — which means you can say no. Politely, in writing, with a legal citation. Deeply satisfying.
Ask the school and every club what photo consent they hold for your child, and set it to no public publication. Withdrawing consent is your right at any time.
Competitive sport: ask how your child appears in published results — many federations accept initials or licence numbers for minors on request.
For photos already online, send the removal letter below, citing the GDPR right to erasure. If an organisation ignores you, escalate to your data protection authority (in Greece: dpa.gr).
Freeze what can't be deleted
One evening of forms — then it's done for years
American children have Social Security numbers, and a child's SSN is a favourite identity-theft target precisely because nobody checks a child's credit for sixteen years — which fraudsters regard as a lovely long runway. These protections are free, one-time, and stronger than any setting.
Freeze each child's credit at all three bureaus: Equifax, Experian, and TransUnion. Look for the minor / protected-consumer freeze — free, requires proof of guardianship. A frozen file means a stolen SSN opens nothing.
Opt out of "directory information" at school. Under US school-records rules (FERPA), schools may publish names, photos and details unless you opt out in writing — one short note to the front office.
Know the deletion rights that exist here: California's minor "eraser" law lets teens demand deletion of what they posted, and Google accepts requests to remove images of anyone under 18 from search via the report content portal.
If a child's SSN was ever exposed: file at IdentityTheft.gov for a recovery plan, and freeze immediately if you haven't.
So you never have to do this again
15 minutes, then it watches for you
A clean name is the cheapest thing in the world to monitor: any new mention is a signal. Set the alarms now, while there's nothing to find — future you will be insufferably grateful.
A Google Alert for each family member's full name in quotes — including each child. If your family's names exist in more than one alphabet (Greek, Latvian, Cyrillic…), set an alert per spelling.
A 15-minute "family sweep check" every three months: private-window search of the names, a glance at platform settings (defaults change after app updates), any new school or club. Add it to Google Calendar with one tap — it lands three months from today and repeats quarterly. Apple-calendar families: a repeating 15-minute event named "Safe Daisy check" does the same job.
Check the parents' emails at Have I Been Pwned — your email is the master key to the family's photo archives — and turn on two-factor for email first.
When the children are old enough for their own accounts: do this sweep with them, not for them. The habit is the inheritance — the whole arc is: protect them when they're little, teach them as they grow, hand them the keys.
If something goes wrong
Read once now; keep for the day you hope never comes
Prevention is the rest of this page. This station is for the bad day — save it now so you're not searching for it in a panic. The order matters: evidence first, then removal.
Preserve before you delete. Screenshot everything — the content, the profile, the URL, the date — before blocking, deleting or confronting. Removal destroys the evidence that reporting needs.
Report in-platform under the child-safety category — those queues are prioritized and can remove content faster than any other route.
For intimate or exploitative imagery of a minor — including AI-generated: Take It Down helps remove it across platforms without uploading the image anywhere; reports go to the CyberTipline. Outside the US, INHOPE lists your national hotline.
If a stranger contacts your child — or threatens them over images: save the evidence, block, report to the platform and to police. Never pay, never negotiate, and make sure your child hears one thing clearly: they are not in trouble, and telling you was right.
If an account is hijacked: change the email password first (the master key), then run the platform's account-recovery flow, then review connected apps and sessions.