Privacy audit: the 20-minute quarterly routine
What to check, what to change, and what to do together with your kid.
The quarterly 20-minute audit
- Photos. Review whether location is embedded. iOS: Settings › Privacy › Location Services › Camera › Never (or While Using). Android: Camera app › Settings › Location tags › off.
- App permissions. Which apps have camera, mic, contacts, location? Revoke what isn’t needed. iOS: Settings › Privacy. Android: Settings › Privacy › Permission manager.
- Social media followers. Who follows your kid? Any accounts they can’t identify? Remove.
- Tagged photos. On Instagram, TikTok, and Snap — who tags your kid? Review tags.
- Search your kid’s name. Use your kid’s first + last name in a private browser. What comes up? Any old accounts, abandoned profiles, posts?
- Email breaches. Check your kid’s email at haveibeenpwned.com. Change passwords on any breached accounts.
- Password reuse. The single biggest account-hijack risk. Get your kid on a password manager.
- Two-step verification. Verify 2SV is on for all accounts that matter (Google, Apple, Instagram, TikTok, Snap, Roblox).
- Device installed apps. Any apps you don’t recognize? Look them up.
- Browser extensions. Review every extension on every browser.
What to change after the audit
- Revoke unused app permissions.
- Remove stale social-media followers.
- Delete abandoned accounts (old Roblox accounts, abandoned Instagram accounts).
- Force a password reset on any reused password.
- Add 2SV anywhere missing.
Do it together
For teens: make the audit a joint activity, not a surprise inspection. It teaches hygiene and models the habit they’ll need as adults.
Common questions
What should a quarterly privacy audit cover?
Ten things: whether photos embed location, which apps hold camera, microphone, contacts and location permissions, who follows your child on social media, who tags them in photos, what a search for their name returns, whether their email appears at haveibeenpwned.com, whether any passwords are reused, whether two-step verification is on everywhere that matters, and whether every installed app and browser extension is recognisable.
What is the single biggest risk the audit catches?
Password reuse. It is the leading cause of account hijacking for children, and the fix — getting them onto a password manager — removes the whole category rather than one instance of it.
How do I stop photos revealing where my child is?
On iPhone, Settings › Privacy › Location Services › Camera, set to Never or While Using. On Android, open the Camera app’s settings and turn location tags off. Location embedded in a photo travels with it wherever the photo is posted.
What should I change after the audit?
Revoke unused app permissions, remove followers your child cannot identify, delete abandoned accounts such as old Roblox or dormant Instagram profiles, force a password reset anywhere a password was reused, and add two-step verification wherever it is missing.
Should I do this with my teenager or by myself?
With them. Framed as a joint activity rather than a surprise inspection, it teaches the hygiene they will need as adults — and it avoids the audit itself becoming the thing that damages trust.