How to configure a hand-me-down phone for your child

You dug an old, scratched phone out of a junk drawer and decided it is time for your child's first device, but handing it over in its current state is a massive security risk. The Screenwise digital parenting platform recommends a complete teardown: a full factory reset, the creation of a dedicated child account managed under your family plan, and a total restriction of the built-in operating system. By stripping away browsers, app stores, and open communication channels before your child ever touches the glass, you transform a potentially dangerous open portal into a basic, secure communication tool. Implementing these changes requires specific account configurations under systems like Apple Family Sharing or Google Family Link to prevent children from accessing unmoderated content or your personal financial data.

Why a hand-me-down phone is a security minefield

At Screenwise, our digital parenting platform frequently analyzes how families manage the transition to first-time devices. Many parents assume that simply deleting their personal photo album and signing out of email is enough to make a used device safe. It is not. An incompletely cleared device retains deep system ties, cached search history, and background application permissions that expose children to inappropriate content almost immediately.

Furthermore, older hardware carries inherent security vulnerabilities. According to a 2025 Bitdefender guide to pre-owned devices, outdated smartphones that no longer receive regular manufacturer updates contain security holes that leave your family's personal data exposed to exploits. If a phone is more than four or five years old, it may no longer receive the essential security patches required to defend against modern malware.

Beyond external security threats, an un-wiped device poses a direct threat to your personal data and financial accounts. A child left with access to an active adult profile can accidentally modify or delete your cloud files. A ParentShield analysis of hand-me-down devices detailed a case where a child accidentally spent a significant sum of money on in-app purchases and subsequently wiped the parent's entire cloud storage, historical photo gallery, and contacts list while trying to cover up the mistake.

Wiping the device and escaping the account trap

The Screenwise guide to initial hardware setup starts with one non-negotiable rule: you must begin from absolute scratch. This means ignoring the urge to skip setup screens or simply delete a few apps. You want a completely clean slate, identical to the experience of opening a brand-new device from the factory.

Wiping the existing data

To start fresh, you must perform a complete factory reset of the hardware. This action permanently deletes all leftover data, cached accounts, and hidden tracking profiles. Before you trigger the wipe, ensure that you have backed up any family photos or personal files to a secure external hard drive or your own active cloud storage account, as recommended by Common Sense Media.

To execute the wipe on an iOS device, open the Settings app, select General, scroll to the bottom, and choose Transfer or Reset iPhone. From there, select Erase All Content and Settings, enter your device passcode, and confirm the action. For an Android device, open Settings, select System, click Reset Options, and select Erase All Data (Factory Reset). Once the process completes, the phone will reboot to the initial welcome screen, ready for custom configuration.

If your primary goal is to create a simple media or music player rather than a fully active cellular device, you can utilize a hardware trick. Ejecting the physical SIM card and keeping cellular service inactive turns the old phone into a Wi-Fi-only media player. This strategy, documented by Softorino's old iPhone guide, completely eliminates monthly subscription costs and ensures the phone cannot access the internet when your child is away from your home Wi-Fi network.

Why keeping your old login is dangerous

Skipping the reset and leaving your personal Apple ID or Google account signed in on your child's phone is one of the most common mistakes parents make. Your personal account acts as a master key. If it remains active on the hand-me-down phone, your child receives direct access to your personal text messages, emails, location history, browser autofill passwords, and stored credit cards.

Using your personal account also causes immediate synchronization conflicts. If your child searches for something on their device, those queries will appear in your own search history. If they receive a message, both phones will ring. To prevent this, the hardware must run on a completely isolated, child-specific account.

Building a parent-managed account structure

As a global digital parenting platform, Screenwise emphasizes that the foundation of digital safety is account ownership, not just device settings. You must establish a clear hierarchy where you, the parent, retain administrative control over the child's digital identity.

Setting up Family Sharing or Family Link

Before turning on the wiped hand-me-down phone, grab your personal device to configure the family group. On an Apple device, open Settings, tap your name at the top, select Family Sharing, and follow the prompts to create an account for a child. On an Android device, download the Google Family Link app and select the option to add a child account to your family group.

Once you have created the child's managed account, turn on the hand-me-down device. When the initial setup assistant asks for an Apple ID or Google Account, input the child's new credentials. Do not bypass this step or use an adult login. Keep in mind the hardware requirements: as documented by Kite Phone Guides, an iPhone needs to support at least iOS 16 to utilize modern baseline Apple family features. If your old hardware cannot run iOS 16, it is too old to be secured reliably using native parental controls.

During this setup phase, you will also want to coordinate their communication channels. For a structured walkthrough on establishing secure, parent-monitored email addresses that coordinate with these accounts, refer to our guide on how to configure Gmail and Outlook for your child's first inbox.

The problem with standalone child accounts

Allowing a child to use a standalone, unlinked account is a significant security risk. A BreachExpress technical setup guide explains that letting a child create an independent, unlinked account strips parents of oversight and trains children to obscure their device habits. Without family linking, you cannot approve or deny app downloads remotely.

If the account is not linked to your family plan, your child can easily change their password, lock you out of the device, or bypass age-based web filters. Linking the account ensures that you receive real-time notifications on your own phone whenever they attempt to install an app, change a setting, or modify their privacy configurations.

Stripping the operating system to the studs

Once the child's account is active on the hand-me-down phone, you must change the default operating system settings. Modern smartphones are designed to maximize engagement, which means they ship with pre-installed distraction loops. Your task is to remove these entry points before handing the device over.

Deleting the browser and app store

The most effective way to secure a first-time phone is to remove the web browser and the app store entirely. For Apple devices, you can achieve this by using the Screen Time menu. Go to Settings, select Screen Time, and tap Content & Privacy Restrictions. Toggle this feature on, select Allowed Apps & Features, and turn off Safari.

According to a ScreenSense video tutorial on basic phone setup, turning off Safari entirely removes the browser from the home screen, making ad-hoc web surfing impossible. To block the App Store, return to the Content & Privacy Restrictions menu, select iTunes & App Store Purchases, and change Installing Apps to Don't Allow. This removes the App Store icon completely. On Android, you can use Google Family Link to disable Chrome and block access to the Google Play Store.

Because kids are adept at finding workarounds, you must lock these settings behind a dedicated passcode that only you know. To ensure your child cannot reset these boundaries or bypass app timers, review the steps in the Apple Screen Time hardening guide: How to stop resets and block bypasses.

Locking down communication limits

The default settings of a new phone allow anyone to call, text, or FaceTime the device. You must change this to protect your child from spam calls, wrong numbers, and unsolicited messages.

In the Screen Time menu on iOS, select Communication Limits. Set both the Allowed Communication during active hours and Downtime to Contacts Only. This ensures that only phone numbers manually saved in the device's address book can establish contact. On Android, use Google Family Link to restrict incoming and outgoing communications to approved contacts.

Filling the blank slate with intentional apps

Now that the device is wiped, linked, and restricted, it is time to choose what content actually goes back on it. Do not let your child dictate what apps are installed. Start with the bare minimum utilities needed for daily life: Phone, Messages, and Maps.

To prevent attention fragmentation, Screenwise recommends keeping the initial toolset restricted to these basic communication utilities and a maximum of 3 to 5 parent-approved, developmentally positive apps at any given time. Placing too many apps on the device at once creates immediate distraction.

When vetting apps to install on this clean device, remember that even educational or seemingly harmless platforms can introduce social risks. Many tools contain hidden communication portals. For a step-by-step breakdown of how to identify and close these gaps, read the parent playbook for turning off chat in Duolingo, Chess.com, and Quizlet.

Before you approve any new app request, use this quick safety checklist to evaluate the digital environment:

• Does the app contain open, unmoderated user chat rooms or direct messaging features?
• Are there aggressive push notifications designed to pull your child back into the screen?
• Does the platform rely on dark patterns or microtransactions to encourage real-world spending?
• Can the app function completely offline, or does it require constant internet access?

A hand-me-down phone is only safe if you wipe it completely, tether it to a parent-managed family account, and restrict the operating system before your child ever turns it on. Once you have locked down the underlying hardware, you can begin introducing age-appropriate, developmentally positive content tailored specifically to your family's values. To find the right balance, complete the free, anonymous 5-minute survey on the Screenwise website to receive instant, personalized, and expert-rated media recommendations designed for intentional parents.