Think You Know What’s on Your Child’s iPhone? The Home Screen Doesn’t Tell the Whole Story, Learn What Can!
CAVEAT: Rather than relying solely on technology to figure out what our children may be doing on their iPhones, one of the most effective things we can do as parents and caregivers is build the kind of relationship where our kids feel comfortable coming to us and openly sharing what they are doing online. Here at The White Hatter, we have always believed that the relationship we build with our children is more important than any parental monitoring application, device restriction, or technological safeguard. Our goal should not be to catch our children doing something wrong, but to create an environment where they are less likely to feel that they need to hide their digital lives from us in the first place.
However, relationship and trust do not mean the absence of reasonable parental oversight. There may be times when something doesn’t feel right, when a child’s behaviour suddenly changes, when a parent becomes aware of a potential online risk, or when there is a legitimate concern about safety. In those circumstances, parents and caregivers may need to trust, but verify. This is particularly true when there are concerns involving cyberbullying, online exploitation, sextortion, grooming, threats, coercion, or other forms of technology facilitated harm. In these situations, understanding what information an iPhone may retain can help parents make more informed decisions about how best to support and protect their child.
That’s the purpose of this article. It isn’t about teaching parents and caregivers how to secretly surveil their children or search their phones looking for something to catch them doing. It’s about helping parents and caregivers understand some of the digital breadcrumbs an iPhone can leave behind, what those breadcrumbs might tell us, what they cannot prove, and how they can help inform a conversation when there is a reasonable reason to look a little deeper.
When parents and caregivers become concerned about what their child may be doing on an iPhone, one of the first things they often do is look at the Home Screen. However, the Home Screen can tell us surprisingly little about how an iPhone is actually being used. An application can be removed from the Home Screen without being deleted, deliberately hidden behind Face ID or another authentication method, used and subsequently deleted, accessed through a web browser instead of a dedicated application, or replaced with another platform that performs essentially the same function.
This is why we encourage parents and caregivers to think in terms of digital breadcrumbs rather than digital proof. An iPhone can retain pieces of information in different locations that, when considered together, may provide a more complete understanding of how the device has been used. However, very few of these breadcrumbs, standing alone, establish exactly what happened, who was using the device, why an application was accessed, or what occurred within it. There is an important difference between identifying evidence of activity and drawing conclusions about a child’s intentions or behaviour.
This guide is intended for parents and caregivers who are responsible for a child’s device and who have a legitimate reason to review its use. It is not intended to encourage secret surveillance or unnecessary intrusions into a young person’s privacy. Particularly with older youth and teens, whenever circumstances permit, we believe device checks should be part of an established family technology agreement and an ongoing conversation about safety, privacy, trust, accountability, and increasing independence.
Technical Note: The instructions in this guide are based on Apple’s documented iPhone features, including those described in its iOS 27 support documentation as of October 2026. The location, appearance, and availability of some settings may differ depending on the iPhone model, installed iOS version, Apple Account configuration, and whether Family Sharing and Screen Time have been enabled. Apple regularly updates its operating systems, which means some navigation instructions may change over time. Parents and caregivers should consult Apple’s official support documentation if a particular feature does not appear exactly as described.
1/ Start With the App Library, Not the Home Screen
Where to look: From the iPhone Home Screen, continue swiping left until you reach the App Library.
One of the first things parents and caregivers should understand is that an application does not have to appear on the Home Screen to remain installed and accessible on an iPhone. Apple allows users to remove individual application icons from the Home Screen while keeping the applications installed in the App Library. Users can also hide entire Home Screen pages, which means multiple applications may no longer be immediately visible when someone unlocks the phone. Consequently, looking only at the Home Screen provides an incomplete picture of what applications are actually available on the device.
The App Library organizes installed applications into categories and provides a searchable inventory of applications that have not been deliberately concealed using Apple’s dedicated Hidden Apps feature. If a parent discovers an unfamiliar application in the App Library, this can establish that the application is currently installed on the device. However, it does not establish when the application was downloaded, whether it was installed intentionally by the child, how frequently it has been used, or what activities occurred within it. Applications can also be restored from a previous device or downloaded through other devices associated with the same Apple Account, depending on the account’s configuration.
It is also important to distinguish between removing an application from the Home Screen and deliberately hiding it using Apple’s dedicated app hiding feature. These are two different functions. An application removed from the Home Screen will generally remain visible in the ordinary App Library, whereas an application hidden using Apple’s privacy feature will not appear in the normal App Library categories or search results.
What this breadcrumb can tell you: An application appearing in the ordinary App Library is strong evidence that it is currently installed on the iPhone.
What it cannot prove: It does not establish who installed it, when it was installed, whether the child actively uses it, or what occurred within the application.
2/ Check Apple’s Hidden Apps Feature
Where to look: Open App Library, locate the Hidden folder, and authenticate using Face ID, Touch ID, or the applicable device authentication method. Depending on the iOS version, hidden applications may also be reviewed through Settings → Apps → Hidden Apps.
Apple has introduced privacy features that allow users to lock or deliberately hide downloaded applications. Although these features have legitimate privacy and security purposes, they are important for parents and caregivers to understand because an application may be installed on an iPhone without appearing in the locations where someone would normally expect to find it.
Apple’s app locking and app hiding features are related but not identical. A locked application may remain visible on the Home Screen while requiring authentication before it can be opened. A hidden application, on the other hand, is removed from normal Home Screen visibility, ordinary App Library listings, and search results, and is placed within a protected Hidden folder. Hiding an application also protects access to it.
Apple acknowledges that information about hidden applications may remain visible in other areas of the device or Apple Account, including certain Screen Time records, Battery information, and App Store purchase history. This means that hiding an application does not necessarily eliminate every indication that it exists or has been used.
There are also important age related safeguards associated with Family Sharing. Apple states that children under 13 who are appropriately configured within Family Sharing cannot use the app-locking and app-hiding features, while teens aged 13 to 17 may have access to these functions. Parents or guardians may still be able to review certain download and usage information through supported family controls. However, the availability of these safeguards depends on the child’s Apple Account, applicable regional age rules, Family Sharing configuration, and software version. These restrictions should not be assumed to apply automatically to every iPhone used by someone under 13.
Parents and caregivers should also understand that knowing a child’s ordinary device passcode does not necessarily guarantee unrestricted access to every protected application in every circumstance. Authentication requirements and security settings can affect how protected applications are accessed.
Most importantly, discovering a hidden application should not automatically be interpreted as evidence of inappropriate behaviour. There are legitimate reasons why someone, including a teenager, might want an application kept private. Privacy and secrecy are not necessarily the same thing, and understanding the difference is an important part of helping young people develop healthy digital independence.
What this breadcrumb can tell you: An application found within Apple’s Hidden Apps feature is currently installed and has been deliberately placed behind the device’s app-hiding functionality.
What it cannot prove: It does not establish that the application is being used inappropriately, that the child is engaging in risky behaviour, or that the child intended to conceal something harmful.
3/ Check iPhone Storage
Where to look: Settings → General → iPhone Storage.
Another useful location for parents and caregivers to examine is the iPhone Storage section. This provides information about applications and the amount of storage space they occupy on the device. It can help identify applications that are not immediately obvious from the Home Screen and may also reveal retained application data.
One particularly important distinction is the difference between deleting an application and offloading it. When an application is offloaded, the application software is removed from the device, but its associated documents and data are generally retained. This allows the application to be reinstalled later without necessarily losing its previous information. An application that has been offloaded may therefore leave evidence of its previous presence even though the application itself is no longer fully installed.
Parents and caregivers should also understand that applications may have been installed automatically, restored from an earlier device, or downloaded through another device associated with the same Apple Account. The presence of an application or retained application data should therefore not automatically be interpreted as evidence that a child intentionally downloaded or actively used it.
Storage information is particularly useful when considered alongside other information, such as App Store download history, Battery activity, or Screen Time records. However, storage information is not an activity log and should never be treated as one.
What this breadcrumb can tell you: It can help establish which applications are installed, which applications have been offloaded, and whether certain application data remains on the device.
What it cannot prove: It does not establish when an application was last used, who used it, what occurred within it, or whether the child intentionally installed it.
4/ Battery Usage Can Be an Excellent Second Breadcrumb
Where to look: Settings → Battery. Depending on the iOS version, select the available battery usage details and examine individual days or reporting periods.
One of the more useful but often overlooked sources of information on an iPhone is its Battery section. Apple provides information about which applications and system activities have consumed battery power during the available reporting period. Depending on the software version, this information can include on-screen activity, background activity, and certain notification-related activity.
This is important because there is a significant difference between discovering that an application is installed and discovering that it has been active on the device. For example, suppose a parent finds an unfamiliar social application in the App Library. That discovery alone provides little information about whether the application is actually being used. However, if Battery information also indicates that the application accumulated 42 minutes of on-screen activity during a particular reporting period, the parent now has another piece of information that may help explain how the device was used.
Apple describes on-screen activity as activity occurring while an application or system function was open and visible on the screen. Background activity, by comparison, refers to activity that occurred while the application was not necessarily being actively viewed. Applications can perform background tasks for legitimate reasons, including refreshing information, processing data, maintaining certain connections, or completing other system-supported functions.
It is also important to understand that battery consumption is not the same thing as time spent using an application. If an application accounts for 10 percent of battery consumption, that does not mean the child spent 10 percent of their device time using it. Different applications consume battery power at different rates, and some applications can use substantial battery power while operating in the background.
Battery information also has limitations. It is not a permanent historical record, and the amount of information available depends on the iPhone’s software version and reporting period. It also cannot establish who was physically operating the device. An application may have been opened by another person with access to the phone, or it may have become visible through an interaction initiated from a notification or another application.
What this breadcrumb can tell you: On-screen activity provides evidence that an application was open and visible during the reporting period. Background activity indicates that the application performed activity without necessarily being actively viewed.
What it cannot prove: It does not establish who used the application, what they were doing within it, or whether background activity represented intentional interaction.
5/ Screen Time Can Provide a Much Better Picture
Where to look: Settings → Screen Time → See All App & Website Activity, or the equivalent activity-reporting option available on the installed iOS version. Review the available daily and weekly information.
For parents and caregivers who have configured Screen Time, this can be one of the more informative sources of information about how an iPhone is being used. Depending on the software version and settings, Screen Time can provide information about application activity, website activity, device pickups, notifications, and usage patterns over time.
Rather than focusing exclusively on the total number of hours a child spends using their iPhone, we encourage parents and caregivers to examine patterns and context. For example, an unfamiliar application showing repeated activity may warrant a conversation about what the application is used for and why it is appealing. Similarly, a substantial number of notifications from an unfamiliar application may provide another reason to ask questions. Device pickups can offer additional context about how frequently the phone is being checked, although they do not establish what motivated each interaction.
Screen Time becomes particularly useful when a child’s Apple Account is appropriately managed through Family Sharing. Apple provides parents and caregivers with tools to review certain activity information and establish restrictions that reflect the child’s age, developmental readiness, and family expectations. However, the information available depends on whether App & Website Activity has been enabled, how Family Sharing is configured, whether activity is shared across devices, and which versions of Apple’s operating systems are being used.
There is also an extremely important limitation that parents and caregivers should understand. Apple acknowledges in its Screen Time security documentation that clearing Safari browsing history or deleting an application can remove corresponding usage information from the device and other synchronized devices. This means Screen Time should not be considered a permanent or tamper-proof record of everything that has occurred on an iPhone.
The absence of an application or website from Screen Time does not necessarily establish that it was never accessed. Usage information may be unavailable because the application was deleted, browsing history was cleared, activity reporting was disabled, the activity occurred outside the available reporting period, or another reporting limitation applies. Apple’s documentation also does not establish that every historical usage record will disappear in every circumstance when an application is deleted.
This is why we encourage parents and caregivers to use Screen Time as one source of information rather than treating it as a definitive record of their child’s digital behaviour.
What this breadcrumb can tell you: Screen Time can provide useful information about reported application and website activity, usage patterns, notifications, and device interactions during the available reporting periods.
What it cannot prove: It does not necessarily provide a complete history of device activity, establish who was operating the device, or explain what occurred within an application.
6/ Check App Store Download and Purchase History
Where to look: Open the App Store, tap the account or profile icon in the upper-right corner, and locate Apps or Apps & Purchase History, depending on the iOS version. Review applications associated with the Apple Account, including those no longer installed on the current device.
An application that has been deleted from an iPhone may still leave another digital breadcrumb through the Apple Account that was used to obtain it. Apple’s App Store maintains records of applications associated with an account, including applications that may no longer be installed on the device.
This can be particularly useful when parents and caregivers have a legitimate concern that an application was previously downloaded, used, and subsequently removed. However, it is important to distinguish between an application’s download history, its purchase history, and its current installation status. These are related but different pieces of information.
For example, when searching for a specific application in the App Store, an Open button generally indicates that the application is currently installed and available to open. A cloud download symbol may indicate that the application was previously obtained through the Apple Account and can be downloaded again. However, the cloud symbol does not establish that the application was previously installed on the particular iPhone being examined.
App Store records are associated with an Apple Account rather than serving as a complete installation history for one specific device. An application appearing in the account’s history may have been downloaded on another iPhone or iPad, obtained years earlier, or associated with another device using the same account. Consequently, parents and caregivers should avoid assuming that an application appearing in download history was recently installed or actively used by their child.
Parents and caregivers should also understand that Apple’s account-level purchase and download records are not necessarily a complete record of every application ever used on a device. Account changes, hidden purchases, and other circumstances can affect what information is visible.
What this breadcrumb can tell you: App Store records can establish that an application has been associated with a particular Apple Account.
What it cannot prove: They do not necessarily establish that the application was installed on the child’s current iPhone, that the child personally used it, or when it was last accessed.
7/ Look at Safari, but Understand Private Browsing
Where to look: Open Safari and access its History section using the navigation available on the installed iOS version.
One of the more common misconceptions about online activity is that a child must have a dedicated application installed to access a particular online service. In reality, many popular services can also be accessed through a web browser. Depending on the service and its available features, a young person may be able to access content associated with platforms such as Instagram, Reddit, Discord, YouTube, or other online communities without having the corresponding application installed.
Safari’s browsing history can sometimes provide useful information about websites that have been visited. However, parents and caregivers need to understand the limitations of this information before drawing conclusions.
Apple’s Private Browsing feature prevents privately visited pages from appearing in ordinary Safari history. Browsing history can also be manually cleared, and Apple documents that clearing history can remove records of visited pages, recent searches, frequently visited websites, and other browsing information. Depending on the device’s Screen Time restrictions, certain options for clearing history may be unavailable.
It is also important to remember that Safari is not the only browser available on an iPhone. Chrome, Firefox, Edge, Brave, and other browsers may maintain their own histories and offer private-browsing functionality. Some applications also contain built-in browsers that allow users to open websites without leaving the application.
Even when a website appears in browser history, parents and caregivers should be careful about what that information actually establishes. A recorded entry generally indicates that the browser navigated to or loaded a particular address, but it does not necessarily mean the child intentionally searched for that website or meaningfully interacted with its content. Redirects, links opened from other applications, and other browsing activity can sometimes create history entries that require additional context.
Conversely, an empty browser history does not establish that no browsing occurred.
What this breadcrumb can tell you: Browser history can provide evidence that a browser accessed or loaded a particular website.
What it cannot prove: It does not necessarily establish who visited the website, why it was accessed, whether the visit was intentional, or what occurred after the page loaded.
8/ Check Messages’ Recently Deleted Folder
Where to look: Open Apple’s Messages application and locate Recently Deleted. Depending on the iOS version, this may be accessible through Filters, Edit, or the current Messages navigation menu.
Apple’s Messages application includes a Recently Deleted feature that allows certain deleted messages and conversations to be recovered for a limited period. Apple generally describes the recovery window as approximately 30 days, although the precise period and availability can depend on the software version and circumstances.
This feature can be particularly relevant when a parent or caregiver has a legitimate concern involving cyberbullying, threats, sextortion, grooming, coercion, or another potentially harmful interaction. In some circumstances, messages that no longer appear in the ordinary conversation list may still be available through Recently Deleted.
However, the presence of deleted messages should not automatically be interpreted as evidence of wrongdoing. People routinely delete messages and conversations for ordinary reasons, including privacy, organization, storage management, or simply because they no longer want to retain them. The fact that a conversation was deleted does not establish who deleted it, why it was deleted, or whether anything inappropriate occurred.
Parents and caregivers should also understand that Apple’s Recently Deleted feature applies to supported messages within Apple’s Messages application. It does not provide access to deleted conversations within third-party applications such as Snapchat, Instagram, Discord, WhatsApp, Telegram, or Signal. Those services operate independently and may have different deletion, retention, synchronization, and recovery features.
If a parent discovers messages suggesting that a child is being threatened, coerced, sexually exploited, or extorted, we recommend prioritizing the child’s immediate safety and seeking appropriate assistance rather than attempting to conduct an exhaustive investigation independently.
What this breadcrumb can tell you: Messages appearing in Recently Deleted were deleted from the ordinary Messages interface and remain available within Apple’s applicable recovery period.
What it cannot prove: It does not establish why the messages were deleted, who deleted them, or whether the deletion was intended to conceal inappropriate behaviour.
9/ Don’t Forget Photos’ Hidden and Recently Deleted Areas
Where to look: Open Photos → Collections → Utilities, or the equivalent location on the installed iOS version, and look for Hidden and Recently Deleted.
Apple’s Photos application includes features that allow users to hide photographs and videos from ordinary library views and recover certain recently deleted content. Depending on the iOS version and security configuration, protected collections may require Face ID, Touch ID, or device authentication before they can be accessed.
Apple also allows the Hidden album itself to be concealed from the normal Photos interface through the Photos settings. Consequently, parents and caregivers who have a legitimate reason to review the device should understand that photographs and videos may not always be visible when simply scrolling through the ordinary photo library.
This can be particularly relevant when dealing with concerns involving screenshots of threatening messages, saved conversations, downloaded images, cyberbullying, intimate-image sharing, or other visual content associated with online activity.
However, finding an image on a child’s device does not necessarily establish that the child created it, requested it, or knowingly saved it. Images can be received from other people, downloaded automatically under certain settings, synchronized through cloud services, or saved through interactions with applications. This distinction is especially important when dealing with unwanted sexual content or intimate images. A child may have received an image without requesting it and may themselves be the victim of inappropriate conduct.
Parents and caregivers should also understand that deleting an image from the Photos application does not necessarily mean every copy has been removed. Depending on how the image was created, shared, downloaded, or synchronized, additional copies may exist in Messages, Files, cloud storage, other applications, or on other devices.
Similarly, discovering that an image has been hidden should not automatically lead to accusations. The Hidden album is a legitimate privacy feature, and privacy should not be confused with wrongdoing.
What this breadcrumb can tell you: The Hidden and Recently Deleted collections may reveal photographs or videos that are not visible in the ordinary Photos library.
What it cannot prove: They do not establish who created an image, why it was saved or hidden, whether it was requested, or whether additional copies exist elsewhere.
10/ Look at Notifications as Another Breadcrumb
Where to look: Settings → Screen Time for available notification counts, and Settings → Battery for certain notification-related activity.
Notifications can sometimes provide additional context about application activity that is not immediately obvious from the Home Screen. Depending on the iOS version and reporting settings, Screen Time may provide information about the number of notifications generated by particular applications. Battery information may also identify certain notification-related activity that contributed to battery consumption.
For example, discovering that an unfamiliar application generated 80 notifications during a particular day provides a different piece of information than simply discovering that the application is installed. It suggests that the application was generating alerts or other notification activity during that reporting period.
However, parents and caregivers should be careful about interpreting what those notifications represent. A notification does not necessarily mean that another person sent the child a message. Applications can generate notifications relating to direct messages, likes, reactions, recommendations, reminders, updates, promotional content, and many other activities.
Consequently, 80 notifications do not necessarily mean that 80 people contacted the child, that 80 conversations occurred, or that the child opened and responded to those notifications.
Notification counts are best understood as another piece of contextual information that may help parents and caregivers identify patterns of application activity. They should not be treated as evidence of the content or nature of communications.
What this breadcrumb can tell you: Notification information can indicate that an application was generating alerts during a reporting period.
What it cannot prove: It does not establish that the child opened, read, or responded to those notifications, or that the notifications represented direct communication with another person.
11/ Check for VPNs and Configuration Profiles
Where to look: Settings → General → VPN & Device Management.
Parents and caregivers who are troubleshooting unexpected internet access, content-filtering issues, or parental control behaviour may also benefit from understanding the VPN and device management settings on an iPhone.
A Virtual Private Network, commonly referred to as a VPN, can route internet traffic through another network connection and is frequently used for legitimate privacy, security, school, workplace, and organizational purposes. Configuration profiles can also be installed by schools, employers, organizations, and device management systems to establish particular settings or restrictions.
VPNs are not inherently suspicious, and their presence should not automatically be interpreted as evidence that a child is attempting to bypass parental controls.
However, some VPN configurations and network-related applications can affect how internet traffic is routed or filtered. Depending on how parental controls or filtering systems have been configured, certain VPN services may interfere with or bypass particular network-based restrictions.
Parents and caregivers should also understand that not every application using VPN-related functionality is intended to conceal activity. Some legitimate security, privacy, and content-filtering applications use similar underlying technologies.
Another important distinction is that the presence of a VPN configuration does not necessarily mean that the VPN was active during the period being examined.
If a parent discovers an unfamiliar VPN or configuration profile, the appropriate next step is to understand what it does, why it was installed, and whether it affects any family safety settings. Its presence alone should not be treated as proof of deliberate circumvention.
What this breadcrumb can tell you: A VPN configuration or management profile exists on the device.
What it cannot prove: It does not establish that the VPN was active, that the child intentionally installed it, or that it was being used to bypass parental controls.
12/ Look for Screen Time Changes, Not Just Screen Time Activity
Where to look: Settings → Screen Time, including the available passcode, family management, and Content & Privacy Restrictions settings.
One of the more useful parental control features Apple provides is the ability to protect Screen Time settings with a separate passcode. This passcode is different from the ordinary passcode used to unlock the iPhone and can help prevent unauthorized changes to certain restrictions.
When Screen Time is managed through Family Sharing, supported versions of Apple’s operating systems can also provide parents and caregivers with information about the use of a child’s Screen Time passcode, including notifications in certain circumstances. The exact information and features available depend on the operating system version and how Family Sharing and Screen Time have been configured.
Parents and caregivers can also use Screen Time’s Content & Privacy Restrictions to limit certain changes to applications, account settings, content access, and other device functions. These settings can be particularly useful for younger children who are still developing the skills and judgment needed to manage their online activities independently.
However, parents and caregivers should avoid automatically assuming deliberate circumvention whenever a restriction appears to stop working or a previously blocked feature becomes available. Software updates, changes to Family Sharing, account configuration, device settings, and parental adjustments can sometimes explain unexpected behaviour.
If Screen Time settings appear to have changed, the first step should be to establish what actually happened. This may involve reviewing the current configuration, checking for software updates, examining available passcode-use information, and having a conversation with the child. The objective should be to understand the situation rather than immediately assign blame.
What this breadcrumb can tell you: Screen Time settings and supported passcode-use information may help identify changes to parental controls or restrictions.
What it cannot prove: An unexpected change does not necessarily establish that the child intentionally bypassed or disabled parental controls.
Putting the Digital Breadcrumbs Together
The real value of these different iPhone features comes from understanding how several pieces of information may support or qualify one another. In digital investigations, this is often referred to as corroboration. Rather than relying on one isolated observation, we look for multiple independent indicators that may help explain what occurred.
Imagine a parent becomes concerned that a particular social media application was installed, used, and subsequently deleted from their child’s iPhone. Looking only at the Home Screen would provide very little useful information because the application is no longer visible. However, a broader review might reveal several different digital breadcrumbs.
For example, the App Store history may indicate that the Apple Account previously acquired the application. Screen Time, if the relevant records remain available, might show 73 minutes of activity on a particular Tuesday. Battery information might independently show that the application accumulated on-screen activity during the same general period. iPhone Storage might indicate that the application is no longer installed, while the App Store now displays an option to download it rather than open it.
Taken together, these observations could provide stronger evidence that the application was previously installed, actively used, and subsequently removed from the device. However, parents and caregivers should understand that not all of these records will necessarily remain available after an application has been deleted. Apple acknowledges that deleting an application can remove corresponding Screen Time usage information, and the availability of historical Battery information is also limited.
Consequently, the absence of one or more of these breadcrumbs does not necessarily contradict the others. Even when several indicators appear to align, they may not establish who was operating the device, why the application was used, what account was accessed, or what occurred within the application.
This distinction is particularly important because digital breadcrumbs can easily be misunderstood when they are interpreted without context. An application may have been opened briefly out of curiosity. A website may have been accessed through an unexpected redirect. A message may have been deleted for an entirely ordinary reason. An image may have been received without being requested. A hidden application may have been placed behind authentication because the teenager values privacy rather than because they are engaging in harmful behaviour.
The more significant the concern, the more important it becomes to distinguish between what the available information actually establishes and what we may simply suspect.
When Safety Is at Risk, Preserve Evidence Before Investigating Further
There is an important difference between reviewing an iPhone as part of ordinary parental oversight and responding to a situation involving suspected criminal activity or serious harm. If a parent or caregiver discovers indicators of sextortion, grooming, threats, online sexual exploitation, coercion, or another potentially criminal incident, we recommend avoiding the immediate deletion of applications, clearing of conversations, resetting of the device, or making unnecessary changes to accounts and settings. These actions can potentially remove information that may later be important to an investigation.
Where appropriate, parents and caregivers should document relevant usernames, account identifiers, dates, times, messages, and other information that may assist law enforcement or a qualified investigator. However, particular care is required when intimate images involving minors are present. Parents and caregivers should not unnecessarily download, copy, forward, or distribute suspected child sexual abuse material in an attempt to preserve evidence. Instead, they should seek guidance from law enforcement or an appropriate child protection reporting organization about how to preserve and report the material safely.
Here in Canada, concerns involving online child sexual exploitation should be reported to the police. Another option is Cybertip.ca, Canada’s national tip line for reporting the online sexual exploitation of children.
Parents and caregivers should also avoid confronting a suspected offender online or attempting to conduct their own investigation by impersonating their child, accessing another person’s account without authorization, or engaging directly with someone suspected of exploitation. These actions can create additional safety concerns and potentially complicate a subsequent investigation.
Most importantly, the child’s immediate safety and emotional well being should take priority over attempting to conduct a complete investigation of the device. If a child has been threatened, manipulated, coerced, or sexually exploited, the response they receive from a parent or caregiver can have a significant impact on whether they feel safe continuing to disclose what happened.
Our role as parents and caregivers is not to become digital forensic specialists. It is to support our children, preserve relevant information where it is safe and appropriate to do so, and seek qualified assistance when necessary.
Digital Breadcrumbs Should Start Conversations, Not Convictions
This may be the most important part of the entire article! Discovering a hidden application should not automatically become an accusation of dishonesty. Finding deleted messages should not automatically lead to the conclusion that a child is trying to cover something up. Seeing an unfamiliar website in browsing history should not immediately become evidence that a child deliberately sought out inappropriate content. Those assumptions can quickly turn an opportunity for meaningful communication into an interrogation.
A more constructive approach might begin with something like, “I came across something on your phone that I don’t completely understand. Before I jump to conclusions, I’d like you to help me understand what I’m seeing.” That type of conversation creates an opportunity for the child to provide context, explain their decisions, and potentially disclose something that may have been difficult for them to discuss.
This does not mean parents and caregivers should ignore legitimate warning signs or avoid setting boundaries. It means that parental oversight is most effective when it is combined with curiosity, education, reasonable expectations, and an understanding of how young people develop judgment and independence.
For younger children, more direct supervision and technical restrictions may be appropriate because they are still developing the skills needed to recognize and respond to online risks. As children mature into adolescence, those safeguards should gradually evolve to reflect their growing capabilities, demonstrated responsibility, and need for appropriate privacy.
This is why we encourage families to establish technology agreements before problems occur, rather than introducing device inspections for the first time during a conflict (1). When children understand what their parents may review, why certain safeguards exist, and how those safeguards will change as they demonstrate greater responsibility, parental oversight is less likely to feel arbitrary or punitive.
There will always be circumstances where a parent or caregiver needs to act quickly, particularly when there are credible indicators of immediate harm. However, for everyday parenting, the objective should not be to become the household digital forensic investigator. It should be to combine reasonable oversight with ongoing communication, education, accountability, and gradually increasing independence.
Technology continues to evolve, applications change, and young people will inevitably discover new digital spaces, privacy features, and ways to work around parental restrictions. This is why technical safeguards, although important, can never replace the value of an informed, ongoing, and trusting relationship between parents, caregivers, and their children. Something we call the human element (2). Here at The White Hatter, we often remind parents and caregivers that we should be raising children who are not only safer online today, but who are developing the knowledge, skills, confidence, and judgment to navigate the online world independently tomorrow.
No application, parental control, or digital checklist will ever provide parents and caregivers with a complete picture of their child’s online life. Technology can help us identify potential risks, but it is the relationship we build with our children that makes it more likely they will come to us when something goes wrong, rather than feeling they have to hide it. Digital breadcrumbs can provide information, but they do not necessarily provide understanding, and that understanding often begins with a conversation.
Digital Food For Thought
The White Hatter
Facts Not Fear, Facts Not Emotions, Enlighten Not Frighten, Know Tech Not No Tech
References:
Sources and Additional Reading
The following official Apple resources provide additional information about the features discussed in this article. Because Apple regularly updates its operating systems and support documentation, readers should refer to the current versions of these resources when reviewing their own devices.
Apple Support: Lock or Hide an App on iPhone
Apple Support: Understand Your iPhone Battery Usage and Health
Apple Support: Use Screen Time to Manage Your Child’s iPhone or iPad
Apple Support: Recover Deleted Messages in Messages on iPhone
Apple Platform Security: Screen Time Security
Apple Support: Delete Safari History, Cache, and Cookies on iPhone
Apple Support: Set Up Parental Controls With Family Sharing
Apple Support: Manage Your Child’s Access to Apps and App Requests
