Most stories that begin with a child spending several hundred dollars in a puzzle game end with a setting that was never switched on. The setup takes about ten minutes and it is the same on every device in the house.
Why the default is not enough
By default, both platforms remember your authentication for a period after a purchase. That window is convenient for adults and is exactly the gap through which accidental spending happens: one authorised purchase, then a stretch during which further purchases need no confirmation at all.
Every platform provides a setting that requires authentication for every purchase individually. It is not on by default, and switching it on is the single most useful change available.
Android, step by step
- Open the Play Store, tap your profile picture, then Settings.
- Open Authentication, then Require authentication for purchases.
- Choose For all purchases through Google Play on this device.
- If a child has their own supervised account, set up Family Link and enable purchase approval so a request comes to you rather than completing on their device.
iOS, step by step
- Settings, then Screen Time, then Content and Privacy Restrictions, and turn it on.
- Open iTunes and App Store Purchases. Set In-app Purchases to Don't Allow, which removes the possibility entirely, or set Require Password to Always Require.
- Set a Screen Time passcode that is different from the device unlock code, otherwise a child who knows one knows both.
- For a child's own Apple Account inside Family Sharing, switch on Ask to Buy so every purchase needs an approval from a parent device.
Set the Screen Time or Family Link passcode to something the child does not know, and do not use the same code as the device unlock. That one detail is what makes the rest of the setup hold.
The parts beyond spending
Two other settings are worth the same ten minutes.
Chat and teams. Several of these games include team chat that is open to strangers and lightly moderated. Most allow a team to be left at any time and many allow chat to be disabled in the game's own settings. For a young player this is worth more attention than the puzzles or even the purchases.
Advertising. Where a game is rated for children, both platforms restrict personalised advertising, but only when the account is correctly set up as a child account. An adult account handed to a child does not get those protections, and that is the most common gap in practice.
If a charge has already happened
This is recoverable more often than people expect, and the route matters.
- Go to the store, not the studio. Google and Apple took the payment and only they can refund it. The developer cannot reverse it even when willing.
- Say what actually happened. A purchase made by a child without permission is a recognised category for both platforms and is treated differently from a change of mind.
- Move quickly. Both have self-service windows that are short, after which the request goes to a slower review rather than disappearing.
- Then fix the setting, because a refund granted once is unlikely to be granted repeatedly on the same device.
Under New Zealand law a contract entered into by a young child is generally not enforceable against them, and unauthorised charges on a card are a matter for your bank as well as the platform. In practice the platform route is faster and usually sufficient, but the bank is a real option if it is not.
A reasonable position on these games and children
Nothing here argues that these games should be kept away from children; they are colourful, harmless and mostly quite good. The mechanisms that need managing are specific and small in number: the purchase path, the chat, the personalised advertising and the notification schedule. All four are controllable from the phone, none requires the game to be removed, and all four stay controlled once set.