Setting Up a Child's Console Account Without Oversharing Data

The first time I helped a friend set up her nine-year-old's Nintendo Switch, the console asked for his full name, birth date, email, region and a profile picture within about four minutes of switching it on. She typed everything in honestly, including his real surname, because the screen gave no hint about who would see what. A week later his full name was showing on another child's friend list, visible to that child's older cousins.

That is the most common privacy mistake I see with children's consoles, and it has nothing to do with hacking. It is the defaults. Each of the big three platforms has decent controls, but they are spread across apps, websites and console menus, and the setup screens rarely explain them. Here is what to fill in honestly, what to fill in carefully, and which switches to flip before the first online match.

Why the birth date is the one field to get right

Parents sometimes enter an adult birth date to skip the approval steps. I understand the impulse, but it is the single worst shortcut you can take. Platforms use the age on the account to decide which protections apply by default. In the United States, the COPPA rules apply to children under 13. Across the EU and UK, data protection law sets a digital consent age between 13 and 16 depending on the country; it is 13 in the UK. An account marked as a child's gets restricted messaging, limited data collection and parental approval for purchases. An account marked as an adult gets none of that.

So enter the real birth date. Be careful almost everywhere else.

What to enter, field by field

Gamertags deserve a second look. "Oliver_Hughes2016" tells a stranger a first name, a likely surname and an exact age. "QuietOtter" tells them nothing. I have seen children pick names that include their football club and their street, which is close to an address. A quick chat about why the name should not point to them usually works better than a rule.

The controls on each platform

Each company keeps its parental tools in a slightly different place, and the menus get rearranged every year or so, so treat these as starting points rather than exact paths.

Nintendo Switch

Install the free Nintendo Switch Parental Controls app on your phone and link it to the console. From the app you can set daily play time, restrict games by age rating, and block posting to social media from the console. Communication with other players is restricted per game or globally under "Communication with Others". In my friend's case, the fix for the surname problem was in the child's Nintendo Account settings on the website, where the account nickname is separate from the name used for billing.

Xbox

The Xbox Family Settings app handles most of it. Under privacy settings for the child, check "Share real name" and set it to "Block". Set "Others can communicate with voice, text or invites" to "Friends" or "Nobody" for younger children. Turn on "Ask a parent" so purchases need your approval on your phone. Microsoft accounts for children under 13 in most regions have sensible defaults, but "Share real name" is worth checking by hand, because I have found it switched on in accounts created through older flows.

PlayStation

Child accounts live under a family manager's account, set up through the PlayStation website or the console's Family Management menu. You can restrict communication, limit user-generated content, set a monthly spending limit (I suggest zero, with top-ups by request), and control whether the child's online status and real name are visible. Sony splits these settings between the console and the website, so check both.

Where the common advice goes wrong

Many guides tell parents to disable online play entirely. For a six-year-old, that is reasonable. For a ten- or twelve-year-old, I think it mostly pushes the activity somewhere you cannot see, usually a friend's house or a phone game with weaker controls. A better approach for that age is to allow play with approved friends only, with voice chat off, and revisit it every few months. Children tend to accept rules that come with a clear path to more freedom.

The bigger blind spot is the parent's own account. Your account is the one that approves purchases and holds the payment card. If it is weak, everything above can be undone by someone who gets into it. Put a unique password on it and turn on two-factor authentication; our explainer on how two-factor authentication works takes ten minutes to follow.

A child's account is only as private as the parent account that controls it.

Data you do not need to give at all

Some extras are optional and quietly broaden what the platform knows. Linking the console to a social media account, sharing contacts to "find friends", allowing gameplay clips to auto-upload, and turning on voice transcription are all optional on at least one platform. I switch them all off for children. If you want a broader sense of what households hand over without noticing, see how to reduce the personal data you leak and our list of personal details you should never hand over online.

I should add a limit to all of this. These controls cover the platform itself. Individual games, especially free-to-play ones with their own chat and accounts like Roblox or Fortnite, have separate settings on top. They are worth a separate session.

A twenty-minute job for this weekend

Sit down with your child and look at their profile from the outside: on Xbox and PlayStation you can view a profile as another player would see it. Check the display name, picture and whether a real name shows. Then open the family app on your phone and confirm three settings: real name hidden, communication limited to friends, and purchases needing your approval. If any of the three is wrong, fix it together and explain why while you do.