Ensuring that young people reap the benefits of the Internet of Things requires proactively attending to the risks they may encounter in entering the world this new technology affords. The e-safety guidelines currently taught in UK schools may not sufficiently prepare children for navigating the risks that come with connected devices. In this paper we describe initial results from the PETRAS project IoT4Kids, exploring the privacy and security implications of children programming the BBC micro:bit, an IoT-ready device designed for children. We report on children’s (ages 9–10) likely uses of the micro:bit and discuss their implications, highlighting shortcomings of e-safety education and policy guidelines for such uses.