Do parental controls work, and how do I set them up?

A platform-independent checklist for choosing, setting, testing and reviewing parental controls without treating them as a safety guarantee.

By FamilyFXWritten April 2026Published 6 August 2026Last reviewed 11 July 2026Next review due 11 July 20276 min readReviewed by FamilyFX

A laptop, a tablet, a phone and a games controller sit together on a desk alongside a wireless router and a house key.

The short answer

Parental controls can reduce access to particular content, contact, purchases or use at certain times, but they cannot guarantee safety or replace a child telling you what happened. Start with the risk you need to reduce. Create a child account using the child's real age, protect the adult administrator account, then check controls at every relevant layer: home network, device, app or platform, game or console, browser and payment account. Set only the controls that earn their place, such as age-based content, contact permissions, location sharing, purchases, downloads or a sleep-time schedule. Test each control while signed in as the child. Check what happens on mobile data, another browser or device, and after an update. Explain the setting, the reason and the review point. Recheck when the child gets a new device, account or access route. Treat bypassing as evidence that the route or rule needs attention, not proof that every conversation failed. Keep regular safety conversations and an easy reporting route alongside the technology.

Controls reduce defined risks; no combination guarantees that a child will not encounter harm.
Use a genuine child account and protect the adult administrator and payment credentials.
Check network, device, browser, app, game, contact, location and purchase layers.
Test from the child's account and through every access route the child currently uses.
Explain, review and combine controls with regular conversation and reporting.

Parental controls work best when “work” has a precise meaning. A purchase password may prevent an unapproved payment. A contact setting may stop messages from unknown accounts. A schedule may close a game at night. None of those controls can make every online interaction safe or tell an adult how the child felt about something they saw.

Use controls as one layer of protection, with conversation, supervision and a route for reporting alongside them.

Before switching everything on, name what you need the control to do:

prevent age-inappropriate content;
restrict contact from unknown people;
stop location sharing;
require approval for purchases or downloads;
create a reliable sleep-time boundary;
limit one app that is displacing another need; or
show an adult enough activity information to supervise safely.

One control may not cover all of these. A setting that filters websites may do nothing inside a game. A console time limit may not affect a phone. A child can be within an age rating and still receive unwanted contact.

Ofcom describes parental controls as a useful way to monitor or limit time and activity, while also advising regular conversations and showing children how to block and report.¹

Map every access layer

Write down what the child currently uses:

Network: home broadband, public Wi-Fi and mobile data.
Device: phone, tablet, laptop, smart television or shared computer.
Account: the child's Apple, Google, Microsoft or other main account.
Service: social platform, streaming service, game, messaging app or AI service.
Console or game account: including voice chat, friends and marketplace features.
Browser: including any browser installed later.
Payment: app store, console wallet, stored card and subscription account.

A control at one layer does not prove the next layer is covered. The UK Government's Kids Online Safety guidance advises parents to consider new places children can access, including games, consoles, social media and VPNs, and to review controls after a new device or as the child gets older.²

Build the account structure first

Create a child account with the child's correct age. Some services use age information to apply safer defaults or restrict features. Do not solve an account problem by entering a false adult age; it can remove protections designed for younger users.

Keep the adult administrator account separate. Protect its password, recovery email, purchase approval and PIN. Check that the child does not remain signed in as the adult on a shared device.

If several children share hardware, give each a profile where possible. A limit designed for a seven-year-old should not silently govern a teenager, and the teenager's account should not become the younger child's route around a setting.

Set the smallest useful group of controls

Work through the risk list. Depending on the service, look for:

age or content level;
search filtering and autoplay;
who can send requests, messages or join a game;
whether voice, camera or direct messaging is available;
profile visibility, location and activity status;
download and purchase approval;
stored payment methods and subscriptions;
daily schedules or downtime;
privacy and data-sharing options; and
reports or notifications visible to the parent.

Use the manufacturer's or service's live instructions. Menus, feature names and defaults change. Ofcom's console guide also notes that controls differ between devices and can cover content, online access, purchases and time in different combinations.³

Do not switch on detailed monitoring merely because it exists. Match supervision to age, need and risk, and tell the child what adults can see.

Test as the child

Seeing a toggle on the parent dashboard is not a successful test. Sign in to the child's profile and try the action the setting is meant to control.

Check whether:

restricted content is blocked;
a new contact can send a message;
a purchase asks for adult approval;
an app closes at the agreed time;
homework saves before downtime begins;
an emergency or trusted contact still works; and
accessibility, communication and health functions remain available.

Then test another route if the child uses it: mobile data, a second browser, a console, a shared tablet or another Wi-Fi network. You do not need to imitate every imaginable workaround. You do need to know what your chosen control covers in practice.

If the child cannot read a warning, process it quickly or explain what was blocked, test that interaction with them present. A technically successful restriction can still fail as usable support when its message is inaccessible.

Explain the control before it surprises the child

Name the setting, the reason, what it affects and when it will be reviewed:

“Purchases now need my password because the prices inside the game were unclear. Playing and talking to your approved friends still work. We will review it when we have practised checking the real-money price.”

For a time control, include a warning and stopping point. An automatic shutdown in the middle of an unsaved task can create distress without teaching a usable ending.

Record the agreement, adult action and review point in the family's digital agreement.

When a child gets around the control

Do not assume one bypass proves addiction, deception or failed parenting. Find the route:

the child discovered the adult PIN;
another account had no restriction;
mobile data bypassed home filtering;
a new browser or app was outside the schedule;
the rule blocked something the child needed; or
the child understood the boundary and chose another way around it.

Close the technical gap, then address the reason. If the child needed a legitimate function, redesign access. If the boundary remains necessary, restate it and adjust supervision. Treat persistent secret access alongside sleep loss, spending, dangerous contact or wider functional harm as a larger problem, not a settings contest.

The government's guidance notes that curiosity and attempts to get around restrictions are normal possibilities, which is one reason it recommends regular conversation and review.²

Keep the reporting route open

Tell the child that a control can miss something and that reporting will not automatically remove every device:

“If something frightening, sexual, threatening or secret gets through, show me. My first job is to help you become safe. We may block a person or pause a feature while we work out what happened.”

Review controls when the child gets a new device or account, after a major update, when circumstances change and on the date in the family agreement. Remove a restriction that no longer earns its place and strengthen one that is not protecting the intended risk.

Parental controls are useful when they do a named job and have been tested. They are not a substitute for a child knowing who will listen when technology does not behave as the settings page promised.

Footnotes

Ofcom's current parent guide describes parental controls as useful tools and also advises regular conversation, correct age registration, blocking and reporting. ↩
The UK Government Kids Online Safety guidance advises testing controls, covering new access routes, reviewing them as children develop and combining them with regular safety conversations. ↩ ↩²
Ofcom's console guidance shows that available controls differ by device and may cover content, online features, purchases and time. ↩

Sources and further reading

[1] UK Government Kids Online Safety campaign. Parental controls. Current campaign guidance (accessed 4 August 2026).
[2] Ofcom. How Ofcom is helping children to be safer online: a guide for parents. Updated April 2026 (accessed 4 August 2026).
[3] Ofcom. Parental controls for games consoles. Updated March 2023 (accessed 4 August 2026).

Start with the risk, not the settings menu