What letting him text actually costs
On giving a twelve-year-old a way to text, and what iMessage and WhatsApp each cost him.
My son is twelve, and we're giving him a way to text his friends. I do data protection for a living, which I'd assumed would make this easy. It hasn't. It's mostly made me aware of how much I'm quietly deciding for him, and how little of the advice is about his data rather than my peace of mind.
So here's the honest version. Two options, what each actually does to his data, and where I've landed.
Start with the part that surprised me. The first decision isn't the app. It's whether he gets a phone number. WhatsApp needs one. Even the private apps need one. Reaching an Android friend through Apple's own Messages app needs one too, because that runs on the carrier, not on his Apple account. The only way to text without a number is iMessage to other Apple users, which leaves out half his friends. So if you want him reaching everyone, a number is the entry fee. It's the most durable identifier he'll own, and miserable to unwind once everything's wired to it.
His mother is finding that out now. Weeks into a new number, she's still turning up services pinned to the old one. The bank. A login code landing where she's stopped looking. Each one needs its own call or form. Nobody decided that number should become the key to her whole life. It just did, an account at a time, until unpicking it became a job. I can't spare him that entirely. His will end up behind his bank and his logins whether we like it or not. What I can do is choose it like it matters, because he'll keep it longer than anything else I set up this week.
Now the two options.
iMessage is the lightest on data, and he already has it. It's end-to-end encrypted between Apple devices, Apple's business isn't built on reading it, and the safety tools work without surveillance. Communication Limits let me decide who he can message. Communication Safety blurs a nude photo on his device before he sees it, without sending me the contents or a report. There are two catches. The first is reach: on its own it only touches other Apple users, though the latest update finally brings encrypted messaging to Android phones through the Messages app, where the carriers support it. The second is quieter and worth fixing. If his iCloud backup is on without Advanced Data Protection switched on, Apple holds a key to that backup, and his messages sit inside it. Turn Advanced Data Protection on and that closes. Most people never do.
WhatsApp is where his friends probably already are, especially the ones abroad, and in March it launched a proper account for under-13s (rolling out by region, so check if it's live where you are). Messaging and calling only, no ads, no Channels, no Meta AI. I control who can contact him and which groups he can join, all behind a PIN, with alerts when he adds someone new. The messages are encrypted, and I can't read them. The catch is the one you'd expect from Meta. Encryption protects what he says, not the fact that he said it. Who he talks to, when, how often, which groups he's in, the contacts on his phone, all of that still feeds the graph. For a messaging app that reaches everyone regardless of phone or country, that's the trade.
One more thing, because the marketing blurs it. A parent-managed account is not a window into his messages. Neither Apple nor WhatsApp will let me read them. To read everything, I'd have to go around them and surveil him, which is a different decision from the one I think I'm making when I tick "managed."
Where I've landed, for what it's worth. Start him on iMessage, with Advanced Data Protection on and his contacts locked to people we know. It's the careful default, it's already there, and it covers the Apple friends and, increasingly, the Android ones. Add a WhatsApp managed account only for the friends iMessage and RCS can't reach. The managed account is what makes that defensible. Standard WhatsApp for a twelve-year-old would be a no, ads, Channels, the lot, and it's the version he's too young for anyway. Stripped back to messaging behind a PIN, the trade is just the Meta metadata, a known cost rather than a surprise. And the number, the actual first decision, I'll hand over once, deliberately, on a plan and a SIM I've thought about rather than the first one the shop offers.
Setting this up for my own child, instead of auditing someone else's school, the thing I keep relearning is that the careful version looks like doing less. Less watching. Fewer accounts. None of it will feel like protection, and he'll never know it was there. You don’t get thanked for the account you didn’t open, or the data that never piled up. Which is the whole point, even if he never sees it.