When the Rules Get Outgrown

1. The hand-me-down phone problem

This is a composite of a real and very common situation, and the point of it is not “kids are sneaky.” The point is that a motivated teen has more time, more peers, and more device options than any rule has enforcement. Old phones and tablets without SIM cards are fully functional social media machines on any wifi. School computers, friends’ devices, web browser versions of every app, and secondary accounts parents have never heard of round out the toolkit. None of this requires technical skill — it requires a drawer and a friend.

Take the lesson gently: if your restriction strategy assumes your child cannot reach social media, it is probably already wrong. The honest question is not “how do I make access impossible?” It is “when my kid gets access — with or without me — what do I want to have been true beforehand?”

2. Why restriction-only has a ceiling

The Canadian Paediatric Society’s screen-use guidance is built around engagement — manage, meaningful, model, monitor — rather than prohibition, and there is a structural reason: prohibition puts all its eggs in one basket (access control) in an environment where access is effectively infinite. MediaSmarts’ Young Canadians in a Wireless World research — Canada’s longest-running study of young people and the internet — has consistently found that household rules matter and are associated with different online behaviour, but that rules work as part of ongoing conversation, not as a substitute for it.

The failure mode of restriction-only is specific and worth naming: it doesn’t remove the risk; it removes the adult. The teen on the drawer-phone is on the same platforms as everyone else — but with no configured protections (the account says she is 19, because that got past the sign-up screen), no one to ask, and a very strong incentive never to mention anything that happens there, because the first casualty of telling would be the secret itself. The riskiest version of social media is the version a kid uses alone, in secret, on a device nobody is allowed to know exists.

Sources: Canadian Paediatric Society, Digital media position statement (2019, reaffirmed 2025); MediaSmarts, Young Canadians in a Wireless World research series.

3. What controls can and cannot do — the honest spec sheet

The introductory course covered the layers (device, app, network, account). The advanced truth is about their boundaries:

• Controls follow the device, not the child. Everything you configure lives on hardware and networks you administer. A second device on someone else’s wifi carries none of it.
• Home-network filtering stops at your front door. Mobile data, the neighbour’s wifi, the library, a friend’s hotspot — all outside it.
• Age protections attach to accounts, not people. Platforms’ under-18 safeguards (restricted DMs, filtered content, private-by-default) only apply to accounts with a minor’s birthdate. A self-registered secret account claiming 19 gets adult defaults — open stranger DMs included. This is the cruel irony of the workaround: the kid evading rules ends up with less protection than the kid whose access was negotiated.
• Controls still matter. None of this is an argument for zero controls — on the devices and accounts you know about, they reduce friction, delay exposure, and enforce agreed limits. They are a seatbelt, not a force field. The CPS lists them under “Manage” for a reason; just don’t ask them to do the job of a relationship.

Sources: Canadian Paediatric Society; Get Cyber Safe, Government of Canada (device and account security guidance).

4. Graduated autonomy: the strategy that survives contact with a teenager

If blanket prohibition reliably produces secret access, the workable alternative is negotiated, expanding access — the digital version of how families already handle driving:

• Access is granted in stages, with conditions, and the conditions are explained. “Messaging with people you know at 13; one feed app at 14 with the account set up together; settings loosen each year that goes well” is enforceable because the teen has something to lose and a legitimate path forward.
• Set accounts up together. Correct birthdate (so the platform’s minor protections actually apply), privacy settings reviewed jointly, DMs from strangers off. Ten minutes of doing this with them beats a year of monitoring software.
• Trade surveillance for check-ins as they age. The CPS’s “Monitor” is about watching for real dysfunction — sleep, school, mood, withdrawal — not reading every message. Reading a 16-year-old’s messages buys you one discovery and costs you every future disclosure.
• Make the deal explicit: honesty is the currency. The teen’s side: no secret devices or accounts. Your side: telling you about a problem never results in blanket confiscation. Write it into the family media plan the CPS recommends — both sides signed.

And if you discover a drawer-phone anyway? Treat it as information, not just betrayal: the rule was outgrown before the phone appeared. The response that preserves the relationship is renegotiating access at the real maturity level — with the workaround acknowledged and retired — not escalating the arms race you were already losing.

Source: Canadian Paediatric Society — family media plans, developmentally-adjusted expectations, monitoring for functional impairment.

5. The serious risks: what they actually look like

Sextortion — the one to know cold

Financial sextortion is an industrial-scale crime: fake attractive profiles initiate contact, build fast intimacy, solicit an intimate image, then immediately threaten to send it to the victim’s family, school, and followers unless paid. Cybertip.ca — Canada’s national tipline, operated by the Canadian Centre for Child Protection — handles roughly ten sextortion reports every day, and about nine in ten Canadian victims are boys aged 15 to 17. It moves fast: first contact to threats can be under an hour. The playbook that works: never pay, never negotiate, stop responding, keep the evidence, report to Cybertip.ca. Paying doesn’t end it — it confirms the pressure works. Your teen has their own version of this in Blackmail Has a Playbook; consider asking them to show it to you.

Intimate images and Canadian law

Two legal facts every parent of a teen should know. First, sharing an intimate image of anyone without their consent is a criminal offence in Canada (Criminal Code s.162.1, in force since 2015). Second, and less well known: Canadian law treats intimate images of anyone under 18 as child sexual abuse material — making, possessing, or distributing them is a serious crime even when the people involved are teens themselves, and whether the image is real or AI-generated. A 15-year-old forwarding a classmate’s image “as a joke” is committing a crime with that tap. Teens need to hear this before it is relevant, not after.

Deepfakes and “nudify” tools

AI tools can now fabricate convincing intimate images from an ordinary photo — meaning a teen who never sent anything can still be targeted. The legal position above doesn’t change: a faked intimate image of a minor is still treated as child sexual abuse material, the fake is the maker’s crime, and the response playbook is identical — evidence, Cybertip.ca, takedown via NeedHelpNow.ca. If your teen is targeted with a fake, the single most useful sentence you can say is: “I know this isn’t your fault, and we know exactly what to do.”

Permanence

The background fact under all of it: 34% of Canadian youth told Statistics Canada they had seen intimate images shared without the person’s consent in the past year. Screenshots defeat every “disappearing” feature; anything sent can be re-shared. Teens who understand this before the first request handle the request differently.

Sources: Cybertip.ca / Canadian Centre for Child Protection (report volumes, victim profile); Criminal Code of Canada, s.162.1 (non-consensual distribution of intimate images); NeedHelpNow.ca (image takedown support); Statistics Canada, Young people and exposure to harmful online content, 2022.

6. If it happens: the no-blame response playbook

The scripts, in order, for the night you hope never comes:

• First sentence sets everything. “Thank you for telling me. You’re not in trouble. We’re going to sort this out together.” The criminal counted on your teen being too ashamed to tell you; your calm is what breaks the scheme’s engine.
• Do not punish the disclosure. Confiscating the phone of a teen who just reported sextortion teaches every kid in their circle that telling parents makes it worse. Consequences for broken rules, if any, come later and separately — safety first.
• Preserve, don’t delete. Screenshots of threats, usernames, payment demands. Deleting feels like making it go away; it destroys the evidence that gets accounts shut down.
• Report: Cybertip.ca for anything involving intimate images or sexual exploitation of a minor; local police are also appropriate — a crime was committed against your child. NeedHelpNow.ca for the takedown steps.
• Watch their mental state, not just the incident. Shame is the dangerous variable in these situations. Kids Help Phone (1-800-668-6868, text CONNECT to 686868) gives them a confidential person who isn’t you; 9-8-8 exists for any moment that feels darker. Saying these numbers out loud, in advance, is not morbid — it is infrastructure.

The check: 25 questions, 85% earns the certificate

Everything below comes from the sections above. Wrong answers show you why — the check is part of the course, not a trap.