More than 95% of South African children are online regularly, according to a UNICEF study cited by Bizcommunity in March 2026, and for most families that means WhatsApp. On a standard account, anyone who has your child's number can message them directly, and nothing in the app stands in the way. Since 11 March 2026 there has been a setting that changes this, and it takes about two minutes on two phones.
What a parent-managed account changes
WhatsApp launched parent-managed accounts on 11 March 2026 for children under 13, or under whatever the minimum age is in your country. The account has to be created by a parent or guardian who is 18 or older, with both phones side by side, and the whole thing is locked behind a six-digit parent PIN that the child never sees.
Once it is live, only saved contacts can message or call your child, and only you can add them to a group. Anything from an unknown number, whether a message or a group invite, lands in a request folder that opens with your PIN, and WhatsApp shows you who runs the group and how many people are in it before you decide. You get alerts when a contact is added, blocked or reported, when a group changes, and when your child changes their own name or profile photo. Meta AI, Channels, Status updates, live location sharing and disappearing messages in one-to-one chats are switched off, and the profile photo and last seen are hidden from anyone who is not a saved contact.
Chats and calls stay end-to-end encrypted, so this is control over who can reach your child rather than a window into what they write. The trade sits in the right place for a 10-year-old, and TechCrunch reported at launch that WhatsApp plans to let parents delay the switch to a standard account by 12 months once the child ages out.
The rollout has been gradual by region since March. Stuff South Africa published a local walkthrough on 13 March 2026, so it has been reaching South African users, though if the option is missing from the menu, update WhatsApp on both phones and look again in a week.
Why this matters more here
A 2024 report by the African Child Policy Forum and ChildFund, cited by eNCA, found that one in five children under 17 has received an unsolicited sexual request online, and that in South Africa a third of those children went on to meet the person face to face. Girls made up 65% of victims.
Ann-Suhet Marx, director and head of litigation at VDM Incorporated, told the Sunday Tribune in February 2026 that grooming in South Africa often starts on gaming platforms with children aged 10 to 12, where an adult builds trust during gameplay and then moves the conversation onto a private messaging app. That handover is the moment a parent-managed account earns its keep, because a stranger who has coaxed a phone number out of a child in a game still cannot get a message through to them.
Marx also pointed to the reason so few of these cases reach a courtroom. Families delete the messages out of panic or embarrassment, and with them goes the evidence that would have supported a prosecution under the Cybercrimes Act. The Film and Publication Board has recorded a rise in online grooming reports for years, and the cases that get investigated are the ones where somebody kept the screenshots.
There is a Protection of Personal Information Act (POPIA) angle for anyone running a business that touches children. POPIA treats anyone under 18 as a child, and sections 34 and 35 prohibit processing a child's personal information unless a competent person, usually the parent or legal guardian, has given prior consent. A school, a sports club, an after-care, a tutoring outfit or a paediatric practice holding learner names, photos, ID numbers or class WhatsApp groups is a responsible party under that standard, and consent from the child does not count.
What to do this week
- Set the account up, with both phones in front of you. On your child's phone, install WhatsApp, tap Agree and continue, open the three-dot menu and choose "Create a parent-managed account", then register their number and enter their date of birth. A QR code appears. Scan it with your own phone, confirm you are an adult, set your six-digit PIN, and finish by entering that same PIN back on your child's device.
- Pick a PIN your child cannot guess. Their birthday, your car registration and the code they have watched you tap into your phone all fail this test.
- Go through the contact list and the groups they are already in. Existing contacts carry over, so the numbers a child collected from a game lobby or a class group last year are still there. Anyone you cannot put a face to, remove.
- Have the gaming conversation. WhatsApp controls do nothing about Roblox, Fortnite or Discord, which is where the first contact usually happens, so the rule worth teaching is that anyone who asks a child to move the chat somewhere private gets reported to a parent, every time.
- If someone has already made contact, keep everything. Screenshot the chat and the profile, do not delete the conversation, and report it to the South African Police Service and to the Film and Publication Board's child protection line. Take your child off the platform if you want to, and keep the account and the messages intact until the report is made.
Where Ubuntu Guard fits
If you run a school, a practice, a club or any business that holds information about children, the parental control on a phone is the easy part and your own records are the harder one. Our cybersecurity assessment covers what personal information you hold, who can reach it, and where your consent and POPIA obligations sit for the children on your books. You get a plain-language report, a conversation to walk you through it, and a list of what to fix first.
Two minutes with two phones takes your child from reachable by anyone to reachable by people you approved. Not sure who can get to the phones in your house or the devices in your business? WhatsApp us and we will walk you through the next step: wa.me/27791595040
Cybersecurity Made Simple
© 2026 Ubuntu Guard Cybersecurity | Durban, South Africa
ubuntuguard.co.za