A parental control app sees almost everything a child does on a device, so choosing the wrong one can create a privacy problem as large as the one it was meant to solve. This guide helps parents and carers decide whether the free controls built into phones, tablets, computers and consoles are enough, and how to judge a paid app if they are not. It covers the main feature areas, how to check the privacy of the app itself, how controls should change as a child grows, and the warning signs in this market. It names no vendors and is written for families, schools advising parents, and anyone choosing tools on a child's behalf.
Key takeaways
- Start with what is built in. Apple Screen Time, Google Family Link and Microsoft Family Safety are free and cover time limits, app approval, purchase approval and content ratings.
- A paid app is mainly for mixed households. Built-in tools work best within one maker's devices; Google says iPhones, iPads and non-Chromebook computers cannot be supervised with Family Link.
- The app's own privacy matters as much as its features. It collects messages, locations and browsing history about a child, so where that data goes, how long it is kept and who can see it are buying criteria.
- Match controls to age. The FTC notes controls work well for young children but teens can often get around them; the UK Children's Code expects children to be told, in age-appropriate ways, when they are being monitored.
- Controls support a conversation, they do not replace it. Agree the rules with the child, review them as they grow, and explain what is monitored and why.
Define requirements
- Ages and stages: a seven-year-old needs a small set of approved apps and no open web; a fifteen-year-old needs sensible time limits, purchase approval and a way to ask for help.
- Devices: list every phone, tablet, laptop, games console and smart speaker the child uses, and who made each one. One maker across the household usually means the built-in tool is enough.
- The risks you are worried about: screen time and sleep, adult content, contact from strangers, overspending in games, or knowing where a child is on the way home. Each points to a different feature.
- How much you want to see: time and app reports, or the content of messages and searches. The second is far more intrusive and carries more data risk.
- Who manages it: one parent, both parents in different homes, or grandparents. Check how many adults each option supports.
For wider family safety advice beyond tools, see Protecting Children Online: A Parent's Guide and the Family Cyber Security Plan Template.
Capability areas
| Capability | What built-in tools offer | What paid apps may add |
|---|---|---|
| Screen time | Apple: Screen Time schedules with weekday and weekend routines and daily time allowances by category. Google: daily limits, weekly schedule, bedtime and bonus time. Microsoft: screen time limits across devices in the family group | One schedule across devices from different makers |
| App approval and blocking | Apple: age ratings for apps under Content and Privacy Restrictions. Google: approve or block apps and adjust app permissions. Microsoft: block apps and sites on Windows, Xbox, Edge and mobile | Category-based blocking and alerts when new apps are installed |
| Purchases | Apple: Ask to Buy (Require Purchase Approval). Google: approval for purchases made through Google Play billing. Microsoft: spending limits on the child's account | Rarely more than the store's own controls |
| Web and content filtering | Apple: website restrictions. Google: mature content restrictions on Google Play. Microsoft: web and search filters in Edge | Filtering in every browser, sometimes through a VPN or network profile |
| Contact and communication | Apple: Allowed Contacts, with messages from new contacts hidden until a parent approves | Monitoring of messages and social media, often with keyword alerts |
| Location | Google: child's location on Android after location sharing is turned on. Apple: location sharing through Family Sharing | Geofence alerts and location history |
| Reports | Activity and app-use reports in all three | Combined reports across platforms |
| Consoles | Console makers' own family settings (for example Xbox settings managed through Microsoft) | Usually none: console settings must be set on the console account |
Third-party apps often need powerful permissions to work, such as device administrator rights, accessibility access, a VPN or a device management profile. That is normal for this category, but it is also why the vendor's security and privacy practices matter so much.
Evaluation criteria
| Criterion | What good looks like | How to check |
|---|---|---|
| Fit for age | Profiles or presets for different ages that can be relaxed over time | Set up a profile for each child during the trial |
| Platform coverage | Every device the child uses, with feature parity stated honestly | The vendor's per-platform feature list; iPhone features are often narrower |
| Data collected | Only what each feature needs; message content collection optional and off by default | Privacy policy and in-app settings |
| Data retention and deletion | Short default retention; full deletion when you cancel | Privacy policy; ask support for the deletion process |
| Security of the parent account | Two-step verification or passkeys on the parent dashboard | Account security settings |
| Transparency to the child | A visible sign on the child's device when monitoring or location tracking is on | Look at the child's device during the trial |
| Tamper resistance | Alerts when the app is removed, disabled or bypassed | Try uninstalling it from the child's device |
| Cost and cancellation | Clear renewal price, online cancellation, data deleted afterwards | Terms of service and account settings |
Questions to ask vendors
- Exactly what data do you collect from my child's device, where is it stored, and for how long?
- Do you read, store or analyse the content of messages, photos or searches, and can I turn that off?
- Is any data shared with or sold to third parties, including for advertising or analytics?
- Is data encrypted in transit and at rest, and who in your company can access it?
- How do I delete my child's data completely, and does that happen automatically when I cancel?
- Which features work on each of our devices, and which do not work on iPhone or iPad?
- Does the parent dashboard support two-step verification or passkeys?
- What does my child see on their device when they are being monitored or located?
- Have you had a security incident, and how did you tell customers?
Red flags
- Marketed as "invisible" or "undetectable". Hidden monitoring tools are the same technology as stalkerware and can be misused against partners and other adults. The ICO Children's Code expects an obvious sign to the child when monitoring or tracking is on. See the Mobile Spyware Infection Response Playbook.
- A vague privacy policy that does not say what is collected, how long it is kept, or who it is shared with.
- Message and photo collection switched on by default for every age.
- No two-step verification on the parent account that holds all of the child's data.
- Requests to sideload the app from outside the official app stores.
- Claims that the app will keep a teenager completely safe. The FTC notes that teens who have been online for years can often get around controls.
Proof of concept
- Set up the built-in tool for each device family first: Family Sharing with a Child Account and Screen Time on Apple devices, Family Link on Android and Chromebooks, and Microsoft Family Safety on Windows and Xbox.
- Use it for two weeks and write down the gaps that actually matter, such as one schedule across an Android phone and an iPad.
- If gaps remain, shortlist two paid apps and read each privacy policy before installing anything.
- Explain to your child what you are trying, what you will see and why. With older children, agree the rules together.
- Trial one app at a time on all of the child's devices, with the most intrusive features off.
- Test it: check the reports, try removing the app from the child's device, and check what the child sees.
- Before the trial ends, check the renewal price and the data deletion steps. If you do not keep it, delete the account and data, then remove the app and any profiles it installed.
- Review settings every few months and at each birthday, and relax them as the child shows they can manage.
How NHI Mgmt Group can help
We publish independent, vendor-neutral security and privacy guidance for families and organisations. Browse vendors in our products directory or contact us. Organisations building services for children should also read the COPPA and Children's Privacy Guide.
Sources: FTC Consumer Advice: Parental Controls · Apple Support: Use parental controls on your child's iPhone or iPad · Google: Family Link help · Microsoft Support: Getting started with Microsoft Family Safety · ICO: Age appropriate design code, standard 11 Parental controls
Related NHI Mgmt Group resources: Protecting Children Online: A Parent's Guide · Family Cyber Security Plan Template · Home Antivirus and Security Suite Buyer's Guide · Mobile Device Security Guide