I allow my 7 year old to play (or did before he dropped his laptop and broke it). Generally that young he only wanted to play grouped with me, which was fine. At that age, they tend to not read chat at all, which is better IMO. I do enforce a strict warmode always enabled policy with my kids. This may sound counter-intuitive, especially since we all play Alliance, but honestly I’d rather they get ganked by some rampaging raid of horde than have to worry about the undesirable element that is much more prevalent in care bear mode.
Standard online safety rules apply, like not giving identifying information or age to people in game, etc. My kids all understand these rules and the reasons behind them. I prefer to arm them with knowledge because I know I can’t protect them forever. YMMV.