Social media, online communities and safeguarding

Deciding to use social media or online communities

When deciding whether to set up an online community, hold a livestreamed event or use a new social media platform, you should consider whether this is the best option for what you want to achieve. For example, if you want to improve or increase communication with parents, do you need to set up a social media account or would an email newsletter be more suitable? Think about what works best for your organisation's aims and needs. You should consider:

• purpose – what and who do you want your community or account to be for? Do your existing policies and procedures support this?
• platform – are you using an existing platform or creating something new? Is this the best platform for your community – what are children and young people already using? If you use more than one platform how will you manage and moderate conversations across them?
• resources – do you have the appropriate resources (eg financial or staffing) to set up and maintain an online community?
• access and restrictions – who will have access to your community? Are there age or access restrictions on particular platforms? Are different age groups segregated and if so, how do young people transition to the next age band? Are parents allowed to join? Can members freely communicate with each other? Do you need to put any checks in place when people sign up?
• house rules – do you have any house rules, and are they accessible to everyone? What do young people agree to when they sign up? Is it clear what is and isn’t acceptable behaviour or language and what the consequences are for breaking the rules? Are there clear ways for people to report any concerns? How will you make sure rules are fairly enforced? 
• moderation – how will you moderate comments and conversations and will this happen before or after comments are published? Do you have processes to respond if a child or young person shares something that raises a child protection concern? 
• risk and reporting – how will you assess and mitigate risk? What content and activity would need to be reported, and what processes do you have in place for this? 

Assessing risk

Setting up an online community comes with risks as well as benefits. It's important that you understand the risks and have a risk assessment in place. You need to take the necessary measures to help keep yourself, your staff and volunteers and children and young people safe online. 

You need a clear analysis of the risks for each platform you use, your online activities and what this means to your organisation, your staff and volunteers and the children and young people who are part of your online community. 

> Find out more about risk assessing online platforms

> Learn about preventing online harm and abuse

Mitigating risk

Once you have identified possible risks, you will then be able to plan how to mitigate them. This includes:

• how you communicate within your organisation and manage your online community
• effective moderation processes that are understood by everyone
• a nominated child protection lead as a key point of contact, and cover arrangements if this person is not available
• clear privacy settings for your forums, communities and social media accounts
• effective use of the safety tools available on your chosen platform
• signposts to other appropriate, vetted and approved sources of support, where young people can go for help outside of your operational hours or when they need more specialist support
• keeping your technology up to date, for example technology and software updates, changing passwords regularly and having appropriate firewalls and certificates. 

You also need to think about where risk can arise and how to deal with risk generally. This includes considering things like: 

• how to respond if something does go wrong
• what you would do in an emergency if you believed a child was in immediate danger 
• how you will resource ongoing support.

Policies and procedures

As well as safeguarding policies and procedures, organisations using social media or online communities should have an online safety policy statement which sets out your commitment to keeping children safe online. 

> See example online safety policy statement

Online behaviour and codes of conduct

You should set out the behavioural standards you expect from adults working or volunteering online with children, and from the children and young people themselves.

Your code of conduct for adults should remind them to always:

• use individual accounts that have been authorised by your organisation to communicate with children and young people, and never use personal accounts
• use the safety settings identified in your risk assessment
• turn on privacy settings on accounts that are used to interact with children and young people
• use an organisational device to communicate with young people – if this isn't possible, senior managers should:
•  authorise individual staff and volunteers to use a personal device on a case by case basis 
• keep a record of this authorisation and who can see the communication
• ensure all communications are relevant to the project, organisation and the young people you work with
• use age-appropriate language and topics.

> Use our behaviour code templates for adults and for children to set clear rules about online behaviour 

You should consider how you will manage and respond to conflict and disagreement between young people in your communities.

Responding to bullying

Children and young people can also experience bullying on social media and in online communities.

Your anti-bullying procedures should include information about how you will respond to bullying that takes place outside your organisation, but involves children who know each other through your activities. This should include online bullying, bullying that happens on the way to and from school, and bullying that happens in other public places.

Photographing and filming children

You may wish to use images or videos of children and young people in your online communities, or you might want to take videos or images during a livestreamed event. Before sharing images or videos, you should make sure you have appropriate processes and policies in place to manage risk, gain consent and keep children and young people safe.

> Find out more about taking, sharing, using and storing images of children

Safer recruitment

You must follow safer recruitment practices for anyone working with children, even if their contact is virtual. This helps make sure your staff and volunteers are suitable to work with children.

> Find out more about safer recruitment and writing a policy statement  

Legislation and guidance

It’s also important to think about your legal responsibilities when creating policies and procedures.

> See the legislation tab on our preventing online abuse page for more information

The Online Safety Act 2023 also places legal responsibilities on online service providers and platforms to keep children safe.

> Find out more about the Online Safety Act 2023

Privacy and confidentiality 

Social media and online communities are often in the public domain. They might be free for anyone to access or closed groups, that are only available to members. 

Some online communities allow private one-to-one conversations, for example using direct messaging on social media platforms. But you should remind your users to never post any private information on public posts, even in a closed group.

Sharing your contact details 

Consider how members of your online community can get in contact with your group or organisation. You also need to have procedures in place that manage the potential risk of people using contact details to disclose harm or abuse. 

You should think about whether the contact details you provide are generic or for a named person. If you provide an email address or a feedback form that allows free text, consider that people can use this for any purpose. They may say something that raises concerns or they may disclose abuse. It’s therefore essential that you have policies and procedures to enable staff to respond quickly and appropriately. 

Consent

Children and young people should be given the opportunity to decide whether they agree to their personal information being shared. If a child doesn’t have the capacity to make their own decisions, you should ask their parent or carer unless doing so would put the child at risk of harm.

If a child or young person refuses to give consent or you’re unable to seek consent, you can still share information with relevant professionals if this is in the public interest. For example, if doing so protects the child from significant harm and promotes their welfare.

>Find out more about the law around data protection

Digital footprints

Staff and volunteers should also be aware of their digital footprint – the information that is available about them online. Children, young people and families may look up the personal social media accounts of people who are working with them so these should be free of inappropriate or harmful content and not provide any personal information such as personal email addresses or phone numbers. 

It's best practice for staff and volunteers not to accept friend requests on their personal accounts from children and families they work with. Encourage staff and volunteers to use privacy tools and carry out regular checks of their settings. They should also use restrictions, where available, to stop others tagging them in posts and images without their approval.

> Find out more about you can manage your online presence in our online safety podcast episode

Moderation and hosting

Moderation and hosting are a vital part of any online community and it's important to think about the resources you have to moderate and respond to content generated by your online community, social media or livestreamed events. 

You may have separate moderators or hosts, or these functions may be combined into one role. It should be clear who the hosts are within your community, and on individual comments.

What is moderation?

Moderation involves checking what people are saying in posts on your public forum and in direct or private messages. Moderators should read every aspect of a message, looking for risk or vulnerability and ensuring content follows the house rules.

What is hosting?

Hosting involves responding to public community messages, and is an important part of managing communities. Hosts can help encourage discussion, reply to queries, and where necessary manage disagreements between users. 

Why are moderation and hosting important?

Moderators manage the safeguarding aspects and hosts manage the interpersonal and relationship aspects of the community.

Moderation can also help identify risks.  When assessing risk, moderators should consider:

• the individual message
• the wider context of the discussion
• the history of a young person's communications.

This can help establish whether risk is building up over a series of messages or posts.

Deciding how to moderate your online community

From the outset, you need to consider how you will handle moderation, including:

• transparency about how your platform is moderated
• how your moderators work consistently across different platforms and message types
• when you're platform will be moderated, how regularly messages will be looked at, and expected response times
• whether hosts and moderators use individual logins or access is shared
• if moderators posting publicly should use their own first name or a host name 
• how you will manage handovers at the end of each shift
• what training you will put in place to help moderators recognise the signs of abuse and neglect 
• whether you have the appropriate support and supervision in place, and how this is managed for remote and office-based moderators.

You must also ensure that your moderators have the confidence and knowledge to moderate effectively and safely. They should receive regular and relevant training and have access to regular supervision.

Managing moderation and hosting

Moderation and hosting may require different approaches depending on the community or event and which platform you use. 

Try to use different hosts or moderators at different times. If only one person replies to a young person’s posts or messages, there is a risk that this could build up a young person's reliance or dependency on that individual. Young people may also be able to identify a host or moderator by the way they communicate. 

If only one person is hosting or moderating your community, it's important that they can recognise the signs of dependency and take appropriate action. They must also maintain professional boundaries, for example by only responding in stated times and maintaining a supportive but professional relationship, referring to any guidelines and ways of replying that are in place. 

Setting moderation times

You don't have to constantly moderate your community, but you do need to be clear about timings and these need to be part of your procedures.

Think about for how long and during which hours your content will be moderated. It's good practice to check content at set times and intervals, and do this consistently each day, so that the same practices and processes are adhered to throughout all the times of your moderation.

You also need to consider whether messages are monitored constantly during set times or whether they are checked at regular intervals. 

Some social media platforms allow you to publish or unpublish content at the times you set, which means your members can't publish or access unmoderated content outside of those times. 

Your site or platform should clearly state when messages are moderated and read, and when young people posting can expect a response.

Outside of moderation hours

Think about what happens outside of moderation hours. It is possible that messages or comments waiting to be checked or published highlight a risk to or concern about a child or young person. So it's important to be clear about the times when messages aren’t checked. 

You should visibly signpost to alternative sources of help for times when you will not be available, so that young people can get support and advice elsewhere. Make sure any other sources of support are suitably vetted and approved. 

Handovers

Make sure your moderators know who to pass information to at the end of each shift. This should include: 

• recording any key points or issues of concern: This should include message times, platform, keywords and things you might need to find out more about
• highlighting any potential risks: If a specific message highlights a risk, record whether this is an isolated message or if the young person has a history of posting messages of concern, so you can consider cumulative risk
• following your organisation's policies regarding handovers: Concerns should not be handed over to the next moderator to report. You are responsible for reporting any concerns you have about a young person's welfare.

Responding to concerns

Social media and online communities are interactive. Although you may intend to use the platform or app for a purpose such as giving out information, children and young people may use the online community to contact your organisation or comment about activities. They may also disclose abuse or neglect, whether directly or indirectly.

If posts or comments by children or young people raise a concern about their wellbeing then you need to respond appropriately. 

If you think a child is in immediate danger, contact the police on 999.

If you're worried about a child, but they aren’t in immediate danger, you should share your concerns. 

• Follow your organisation's child protection procedures. Organisations that work with children and families must have safeguarding policies and procedures in place.
• Contact the NSPCC Helpline on 0808 800 5000 or by emailing help@nspcc.org.uk. Our child protection specialists will talk through your concerns with you and give you expert advice. 
• Contact your local child protection services. Their contact details can be found on the website for the local authority the child lives in. 
• Contact the police.

Some posts will clearly pose a safeguarding or child protection concern, others will be less clear. But it’s important you know how to respond.

Concerns about online abuse or inappropriate behaviour should be reported to the person in your organisation responsible for safeguarding issues.

Always refer to your safeguarding and child protection policies so you understand when you should be reporting concerns. When in doubt, always share your concerns.

If a message disclosing abuse, neglect or another safeguarding concern is posted publicly, you should also consider the impact of this on your wider community and address any resulting risks. 

> See our information about recognising and responding to abuse

> Find out more about responding to online safety concerns

If your organisation doesn't have a clear safeguarding procedure or you're concerned about how child protection issues are being handled in your own, or another, organisation, contact the Whistleblowing Advice Line to discuss your concerns.

> Find out about the Whistleblowing Advice Line on the NSPCC website

When you're not sure

The NSPCC Helpline can help when you're not sure if a situation needs a safeguarding response. Our child protection specialists are here to support you whether you’re seeking advice, sharing concerns about a child, or looking for reassurance.

Whatever the need, reason or feeling, you can contact the NSPCC Helpline on 0808 800 5000 or by emailing help@nspcc.org.uk

Our trained professionals will talk through your concerns with you. Depending on what you share, our experts will talk you through which local services can help, advise you on next steps, or make referrals to children’s services and the police.

>Find out more about how the NSPCC Helpline can support you

Confidentiality

Never promise a child that you'll keep what they're telling you a secret. Explain that you may need to share what they've told you with someone who will be able to help. Your child protection policies and procedures need to cover what you should do if a child shares something that causes you concern.

Where possible children and young people should be given the opportunity to decide whether they agree to their personal information being shared with other organisations in order to get them the support they need. If a child doesn’t have the capacity to make their own decisions, you should ask their parent or carer unless doing so would put the child at risk of harm.

If a child or young person refuses to give consent or you’re unable to seek consent, you can still share information with relevant professionals if you have a safeguarding concern. Information sharing is key to safeguarding and promoting the welfare of children. It helps professionals build a clearer picture of the child's life, gain a better understanding of any risks they are facing, and helps ensure the child gets the right help at the right time.

>Find out more about the law around data protection

If a child needs to talk confidentially, you should signpost them to Childline. 

Childline

All children and young people can contact Childline if they would like confidential advice and support. Calls to 0800 1111 are free and children can also contact Childline online or get information and advice on the Childline website.