Buying a used phone for your kid: the safety checklist

Buying a used phone or tablet is a practical way to save money, but the previous owner can leave behind more than scratches. An account that wasn’t signed out can lock your child out of setup entirely. Management software installed by a school or employer can give a stranger remote access to your child’s device. This checklist covers what to clear, in what order, before your child touches the device.

Why isn’t a factory reset always enough?

A factory reset wipes the files, apps, and photos stored on a device. It does not automatically remove the previous owner’s Apple ID or Google account. Those accounts can trigger anti-theft locks that stop your child from finishing setup — or leave the device silently linked to someone else’s payment method, cloud backups, or location history.

On iPhones and iPads, this lock is called Activation Lock. On Android phones and tablets, it’s called Factory Reset Protection (FRP). Both are designed to deter theft, and both will block your child if the previous owner didn’t sign out before handing over the device. The fix is the same in both cases: remove the account first, then reset.

How do you safely wipe a used iPhone or iPad?

These steps must be done by the previous owner while they still have access to the device and their Apple ID password. If you are buying from a private seller, ask them to complete these steps before you collect the phone — or do them together.

1. Turn off Find My — Settings › [owner’s name at the top] › Find My › Find My iPhone › toggle off. The owner must enter their Apple ID password to confirm.
2. Sign out of Apple ID — Settings › [owner’s name] › scroll to the very bottom › Sign Out. This removes Activation Lock. The device is now safe to erase.
3. Erase all content and settings — Settings › General › Transfer or Reset iPhone › Erase All Content and Settings. The phone restarts to the “Hello” setup screen, with no previous owner data.

If you already have the device and the previous owner’s Apple ID is still on it, ask them to sign into appleid.apple.com, go to Devices, and remove it from there. Apple can also remove Activation Lock if you have proof of purchase — see Apple’s own support page on iCloud Activation Lock.

Once the device is erased, set it up fresh with a child Apple Account through Family Sharing. Our iPhone & iPad setup guide walks through Screen Time, App Store restrictions, and Communication Safety for kids.

How do you safely wipe a used Android phone or tablet?

On Android, the order matters: remove the Google account first, then factory-reset. If you reset the device while a Google account is still signed in, Factory Reset Protection stays active. The next person to set it up will be asked to enter the previous owner’s Google credentials — and won’t have them.

1. Remove the Google account — Settings › Accounts › Google › [account address] › Remove Account. If more than one Google account is signed in, remove them all.
2. Wait 72 hours — A security update introduced in 2023 keeps Factory Reset Protection active for 72 hours after you remove an account. Plan for this delay before you need to hand the device over.
3. Factory reset — Settings › General Management (Samsung) or System (Pixel and other Android) › Reset › Factory Data Reset › Reset. Confirm when prompted. The phone restarts with no previous accounts.

Once reset, set up a supervised Google account using Family Link. Our Android setup guide covers Family Link, Play Store restrictions, and Digital Wellbeing time limits.

Could a used device still have management software on it?

Yes — and a standard factory reset won’t remove it. Phones and tablets that were previously used by a school, employer, or corporate device scheme are often enrolled in Mobile Device Management (MDM). That software lets the original administrator push apps, wipe the device remotely, or monitor activity — even after you’ve reset it.

Before your child uses any second-hand device, check for leftover management profiles:

• iPhone or iPad — Settings › General › VPN & Device Management. If a profile appears that you don’t recognise, the device was managed. It cannot be safely used until the original organisation removes the enrollment.
• Android — Settings › Biometrics and Security › Device Admin Apps (Samsung), or Settings › Security › Device Administrators (other Android). Any app listed there that you don’t recognise may be an MDM agent.

What else should you check before handing it over?

Once you’ve confirmed the device is fully cleared, a few more checks are worth five minutes before your child starts using it:

• Check the IMEI — enter the device’s IMEI number (found in Settings › General › About, or on the box) on your carrier’s website before you buy. A stolen or blacklisted IMEI can be blocked from all networks mid-use, leaving the phone unable to make calls or use mobile data.
• Confirm the OS still gets security updates — a device whose manufacturer has ended software support is a security risk, however cheap it was. Apple publishes a list of supported models; Android support varies by manufacturer.
• Start fresh, don’t restore — do not restore the previous owner’s backup. Set up your child’s device from scratch so their contacts, messages, saved passwords, and app purchases don’t carry over.
• Set up a child account before your child signs in — on iPhone, create a child Apple ID through Family Sharing; on Android, create a supervised account through Family Link. Adding parental controls after your child has already signed in as an adult is much harder.

If this is a step up from a first kids’ watch or hand-me-down tablet, our first-device migration guide covers the full transition to a first smartphone, including how to move contacts and apps safely.