Safety by design

A patch reacts. A design decision chooses the default before launch: who creates the account, what the child can publish, what the model will not do, and who is told when something looks like distress. NIST's AI risk work treats these as controls you plan, test, and keep, not as a footer on a marketing page.

For children's products, safety by design overlaps age-appropriate design and privacy by default. The protective setting should not depend on a parent finding a submenu. If the child can open a second account you cannot see, the safe default on the family profile does not cover that other login.

Harms that show up in the news were often possible on day one. Companion apps that parents cannot open, public uploads with no approval, and chats used to train models are design outcomes. They are expensive to unwind after a million accounts exist.

Buyers, including schools and brands, should ask for the default, not the promise. What is on when nobody changes a setting? Who is the account holder? What happens in distress, and what does the product refuse to do, such as calling emergency services on its own?

Safety by design means the protective path is the default, not a patch added after harm. HeyOtto starts as a family product: a parent creates the account for ages 8–18, and the child does not self-enroll. There are no ads. Chats are not sold and are not used to train other models. Public sharing waits for parent approval. Distress produces an alert and crisis resources in the chat, and HeyOtto does not auto-contact emergency services.

• Under 13, verifiable parental consent is part of setup.
• Topic limits and tool permissions are per child.
• Public sharing of a project waits for parent approval.