Child identity theft is up 40 percent in three years. The fix is mostly device defaults, not parenting.
The Federal Trade Commission logged a 40 percent jump in child identity theft between 2021 and 2024. Javelin Strategy and Research put the harder number next to it, half of all child victims are nine years old or younger. That combination tells you where the leak is. It is not the child uploading things recklessly, it is the adults around them generating a data trail the child will inherit a decade later. The good news is the mitigation is boring, repeatable, and fits in about an hour on a weekend.
What is actually leaking
Two things, overwhelmingly. Weak default privacy settings on devices the child uses or is near, and parents casually publishing identifying details on social platforms. Birthdays, school names, home neighbourhoods, team rosters, these are the raw materials fraudsters quietly stitch together into a credit application a decade out.
The difficult part is not knowing what to change. It is doing it once, cleanly, so the setup is right before the next round of birthday pictures and school events hits the family camera roll. Everything below is organised around that single hour.
The sixty minute reset
If you only pick five things from this article, let it be the five in this table. Each entry has its own small reason to exist, and together they close the biggest default holes on the average family device.
What to change
From
To
Why
Default browser on every family device
Chrome
Firefox or Brave
Third party trackers are blocked by default in both, no extension juggling needed.
Default search engine
Google
DuckDuckGo
No search history retention, no ad personalisation, works on every browser.
I lean on Proton VPN for two specific reasons that matter when you are doing this as a family setup rather than a solo one.
First, the free plan is actually usable. No data cap, no trackers, no ads injected into the connection. That means you can install it on the kids tablet and the grandparent iPad without arguing about whether the family needs another subscription.
Second, it is Swiss. The company sits outside the Fourteen Eyes surveillance alliance and operates under the Swiss Federal Data Protection Act, which quietly makes the service harder to compel. For a household making a privacy reset decision, that matters more than any one feature on a comparison grid.
Most of the leaks that lead to a nine year old appearing on a credit report happened years earlier, usually as a direct consequence of adults around the child oversharing on open platforms. Three tools do the clean up work for you, so you do not need to manually file removal requests across dozens of data brokers.
Google Results About You. Free. Submits removal requests for phone numbers, email addresses and physical addresses that appear in Google Search results. Start here because it is zero cost and covers the single most visible surface.
DeleteMe, Kanary or Optery. Paid. All three scan the data broker databases that aggregate and resell personal records, then submit removal requests on a rolling schedule. Pricing sits in the hundred to hundred and fifty dollars per year per adult range at time of writing. Family bundles are available.
Direct requests to schools and leagues. Free, manual. Ask the school district office and your community sports organiser to remove any page that includes your child's full name and photo together. These pages are often the single highest signal source a fraudster uses.
The COPPA window is narrower than parents realise
The Children's Online Privacy Protection Act gives US parents the right to request deletion of data that was collected on a child under thirteen. Every major platform honours this, but the request mechanism is buried three menus deep on purpose. Protections largely disappear at age thirteen even though the data collection does not, so the window to use these tools proactively is narrow.
Google: Family Link lets parents request deletion across YouTube, Search, Chrome and Android.
Meta: Privacy Center then Remove Personal Information covers Facebook and Instagram.
TikTok: Guardian's Portal accepts account deletion for users under thirteen.
Snapchat, Roblox and Discord: All have equivalent flows. Search the help centre for the phrase parent request.
The AI training data problem that did not exist a decade ago
This is the category parents tend to miss. In 2023 researchers from Google, DeepMind and UC Berkeley demonstrated in MIT Technology Review that generative image models can memorise and reproduce real training photos. A social media post can be deleted. A photo that has already been scraped into a training set is effectively permanent.
For a child, that creates a risk window that extends into adulthood. A public photo posted this Thanksgiving could contribute to an AI generated likeness of the same person as an adult in 2042, without their knowledge or consent. There is no takedown path once the data is in a trained model.
The practical response is simpler than it sounds. Set all photo sharing to private or close friends only. Avoid AI photo filter apps that upload to the vendor's cloud, because most add your uploads to their training corpora whether the terms state that clearly or not. Audit older posts on a yearly cadence rather than trying to retroactively remove individual uploads.
The quarterly habit that keeps this working
The initial hour is the hard part. Maintenance takes about ten minutes every three months.
Open phone settings and re-check app permissions. New installs often ask for contacts, location or mic that they do not need.
Re-run Google Results About You for every family member. New records surface constantly.
Reset the advertiser ID on each device. iOS: Settings then Privacy then Apple Advertising then Reset. Android: Settings then Google then Ads then Reset.
Audit the last quarter of social posts for anything that reveals school, birthday, address or sports team.
Check Proton VPN is still active on each device, especially travel laptops and tablets that were last used on hotel Wi-Fi.
Frequently asked questions
Is a free VPN actually safe to install on a kids tablet?
It depends which one. Most free VPNs make money by selling bandwidth or injecting ads, which is worse than no VPN. Proton VPN is the one exception worth defaulting to because the free tier has no data cap, no ads, no trackers and is run by a Swiss company that publishes its code open source and submits to independent audits.
At what age should a child be running their own device setup?
The practical answer is thirteen, because that is when COPPA protections drop off and platforms start collecting data on the child directly rather than via parental proxy. If your household manages device setup for a child under thirteen, every tool mentioned in this article applies to the parent account, not the child.
Which data broker removal service should I pick first?
If budget is zero, use Google Results About You and submit school roster removal requests manually. If you can spend a hundred dollars a year, start with any of DeleteMe, Kanary or Optery. They all cover roughly the same broker list and will cut the published surface area for your family within three months of running.
Does the FTC statistic include online fraud or just offline identity theft?
Both. The 40 percent year on year jump between 2021 and 2024 covers credit applications, fraudulent tax filings and account creation using a minor's personal data. Online over sharing is the single largest upstream driver, which is why device setup matters more than it feels like it should.
We use cookies to see which reviews and buying guides readers find useful, so we can keep improving them. Accept analytics cookies, or carry on with essential ones only. See our Cookie Policy.
Get it on 
Download on the 