I assume this situation is the one everyone is talking about.
A few days ago my son (almost 12) was playing with my old iPod Touch I gave him and his sister (almost 11) after I got my iPad. They both understand that they are only allowed free apps, and every time they want a new app, come to me, let me see what it is, and I will download it (or not). I have noticed that sometimes it asks me for my password and sometimes it doesn't, and I was never sure why it didn't ask every time. But since the kids know to ask me every time, I figured it was an acceptable risk. They are really good kids (honestly) and I seriously doubt they'd try to get around the rules deliberately. That may sound naive, but I know how they behave on a daily basis.
Anyway, I had just downloaded a goofy free app for him (it's a face that you can poke in the eye, tickle the chin or corner of the mouth, etc. and it laughs or cries...totally useless but hilarious to kids). I was standing right beside him as he tested out the app to see what all the buttons do. Little did I know that there was an "in app upgrade" available that unlocked a few more capabilities related to torturing the goofy face. Before either of us knew what had happened, he had purchased the upgrade with two touches...one touch on the locked feature and one touch on an "ok" button to buy the upgrade. He did it so quickly, neither of us had time to read the message that popped up, and no password was requested. I realized what happened when the "thank you for upgrading" (or whatever) appeared, and I said..."uh...you just bought an upgrade." He had no idea that he had done it and was mortified. He did get in trouble for not being careful and reading what he was agreeing to by touching "ok," but it was hard to be very forceful about it because it was clearly an accident and WAY too easy. I didn't even know the amount of the upgrade price until I checked the bank account online the next day.
Needless to say, I'm not a huge fan of in-app upgrades, especially on apps that are clearly designed for kids, and when no password is requested. I may be "a bad parent" but I would like to know if there is a way to prevent this from happening in the future, like a setting that requires the password for any purchase or upgrade at all times. If anyone knows, I would appreciate the help,