Device Controls and Network Controls Together

Part 1 of this series covered network-level protection — DNS filtering, router hardening, and scheduled access. Those controls cover every device on your home network but stop working the moment your child connects to a different network: school Wi-Fi, a friend's house, or mobile data.

Device-level controls travel with the device. They enforce screen time limits, block inappropriate content, restrict which apps can be installed, and report activity back to you regardless of which network the device is connected to. The two layers complement each other. Neither is sufficient alone.

This guide covers the built-in parental control systems on every major platform your children are likely to use, plus browser-level and gaming platform controls that apply across all of them.

Windows — Microsoft Family Safety

Microsoft Family Safety is built into Windows 10 and Windows 11 and managed through the cloud, so you can adjust settings from your phone or any browser.

Set Up a Child Account

Your child needs their own Microsoft account. Do not let them use your account or a shared local account — that defeats every control.

Open Settings > Accounts > Family and click Add a family member > Add a child. If your child does not already have a Microsoft account, create one. Microsoft asks for the child's date of birth. For children under 13, the account is automatically designated as a child account with restrictions enabled.

Once added, the child's account appears in your Family Safety dashboard at family.microsoft.com. All settings are managed from here.

Screen Time

In the Family Safety dashboard, select your child and go to Screen Time. You can set:

Screen time limits apply across all Windows devices the child signs into, and optionally across Xbox and mobile devices linked to the same account.

Content Filters

Under Content Filters, configure:

Activity Reports

Enable Activity Reporting to receive weekly email summaries of your child's screen time, websites visited, apps used, and search queries. You can also view this in real time from the dashboard.

Activity reports are not about surveillance for its own sake. They show you what your child is interested in and whether the controls you have set are appropriate. A child consistently hitting their time limit on educational apps might need a higher limit. A child searching for content that bypasses the filter might need a conversation.

Important: Edge Only

Microsoft's content filtering only works in Microsoft Edge. If your child uses Chrome, Firefox, or another browser, the web filter does not apply. Either remove other browsers from the child's account or set an app restriction that blocks them.

macOS — Screen Time

Apple's Screen Time is built into macOS and managed either on the device or through Family Sharing from your own Apple device.

Set Up Family Sharing

Open System Settings > Family Sharing on your Mac (or Settings > Family on your iPhone) and add your child's Apple ID. If your child is under 13, you create a managed Apple ID for them during this process.

Once the child is in your Family Sharing group, you manage their Screen Time settings remotely from your own device.

Screen Time Settings

On the child's Mac, go to System Settings > Screen Time, or manage remotely from your device. Set a Screen Time passcode — this prevents the child from changing the settings. Use a passcode your child does not know.

Downtime

Downtime sets hours when only apps you approve are available. During downtime, the device is essentially locked to phone calls and whatever apps you have placed on the Always Allowed list. Set this to cover bedtime hours: for example, 20:30 to 07:00 on school nights.

App Limits

App Limits lets you set daily time limits per app or per category. Categories include Social Networking, Games, Entertainment, and Education. Set limits on the categories that consume the most time and leave Education unrestricted.

When the limit is reached, the app shows a "Time Limit" screen. The child can request more time, which sends a notification to your device.

Communication Limits

Communication Limits controls who your child can communicate with in Phone, FaceTime, Messages, and iCloud contacts. During allowed screen time, you can limit communication to contacts only (people in their address book). During downtime, you can restrict it further to specific contacts.

Content and Privacy Restrictions

Under Content & Privacy Restrictions, enable:

Shared Across Devices

Screen Time settings sync across all Apple devices signed into the same Apple ID through Family Sharing. Limits set on the Mac also apply to the child's iPhone and iPad. Time spent on one device counts toward the total — a child cannot use two hours on the Mac and then two hours on the iPad if you have set a two-hour daily limit.

ChromeOS — Google Family Link

ChromeOS is the operating system on Chromebooks, which are common in schools. Google Family Link provides supervision for Google accounts used by children under 18.

Set Up Supervision

If your child already has a Google account, you can add supervision to it through the Family Link app on your phone (available on iOS and Android) or at families.google.com. For children under 13, Google creates a supervised account during setup.

On the Chromebook, sign in with the child's supervised Google account. Family Link settings apply automatically.

Screen Time

In the Family Link app, select your child and go to Screen Time:

App Controls

Content Filters

Location

Family Link can show you the Chromebook's location (if it has mobile data or is connected to Wi-Fi). More usefully, it shows the location of the child's phone if they have one with Family Link enabled. This is a personal decision — some families find it valuable, others find it intrusive. Discuss it with your child if they are old enough.

Guest Mode and Incognito

Supervised Chromebooks automatically disable Guest Mode and Incognito browsing. The child cannot bypass the filters by opening a guest session or an incognito window. This is one of ChromeOS's advantages — it is harder to circumvent than Windows or macOS controls.

Linux — Manual Configuration

Linux does not have a built-in parental control system comparable to Family Safety, Screen Time, or Family Link. If your child uses a Linux desktop, you need to assemble controls from several tools. This is more work but achieves the same result.

Separate User Account

Create a standard (non-administrator) account for your child. Never give them sudo access or your admin password.

sudo adduser childname

Ensure the account is not in the sudo group:

sudo deluser childname sudo

Screen Time with Timekpr-nExt

Timekpr-nExt is a screen time management tool for Linux that works on GNOME and KDE desktops.

On Ubuntu:

sudo add-apt-repository ppa:mjasnik/ppa
sudo apt update
sudo apt install -y timekpr-next

Open the Timekpr-nExt administration application and configure:

When the limit is reached, the child receives warnings at five minutes and one minute, then the session locks. They cannot unlock it without the administrator password.

DNS Filtering

Apply DNS filtering at the system level for the child's account. Edit /etc/systemd/resolved.conf or the NetworkManager connection to point to filtered DNS (Cloudflare for Families or NextDNS as described in Part 1). If you have already set filtered DNS on your router, this is already covered at the network level.

For additional protection on the device itself, add blocked domains to /etc/hosts:

0.0.0.0  pornhub.com
0.0.0.0  www.pornhub.com
0.0.0.0  xvideos.com
0.0.0.0  www.xvideos.com

This approach is crude but effective as a supplement. Comprehensive host file blocklists are available from the Steven Black project on GitHub. Download the unified list with adult content extensions and install it:

sudo cp /etc/hosts /etc/hosts.backup
sudo wget -O /etc/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn/hosts

The child cannot edit /etc/hosts without sudo access.

Browser Controls

Install a browser extension for content filtering. uBlock Origin with custom filter lists blocks ads and can be configured to block adult content categories. In Firefox, install the extension under the administrator profile and lock it using Firefox's enterprise policies so the child cannot remove it.

Create /etc/firefox/policies/policies.json:

{
  "policies": {
    "ExtensionSettings": {
      "uBlock0@raymondhill.net": {
        "installation_mode": "force_installed",
        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
      }
    },
    "DisablePrivateBrowsing": true,
    "OverrideFirstRunPage": "",
    "SearchEngines": {
      "Default": "DuckDuckGo"
    },
    "Preferences": {
      "browser.safebrowsing.phishing.enabled": true,
      "browser.safebrowsing.malware.enabled": true
    }
  }
}

This forces uBlock Origin to be installed and prevents the child from removing it, disables private browsing, and enables safe browsing protections.

Application Restrictions

Use Flatpak or Snap application permissions to control what the child can install. Without sudo access, they cannot install system packages. For Flatpak apps, you can further restrict permissions using Flatseal.

Mobile Devices

Children's phones and tablets need the same controls as their computers, and often more — a phone goes everywhere, connects to any available network, and has a camera and microphone.

iOS (iPhone and iPad)

Screen Time on iOS works identically to macOS Screen Time, managed through Family Sharing. All the settings described in the macOS section — downtime, app limits, content restrictions, communication limits, Ask to Buy — apply to iOS devices in the same Family Sharing group.

Additionally:

Android

Google Family Link on Android provides:

Install the Family Link app on your phone and the child's phone. Link the accounts during setup. On the child's phone, Family Link runs as a device administrator that the child cannot uninstall.

Browser Controls (All Platforms)

Regardless of operating system, lock down the browser:

Force SafeSearch

If you are using NextDNS or Pi-hole, SafeSearch enforcement happens at the DNS level and covers all browsers on all devices. If you are not using DNS-level enforcement, configure it per browser:

The DNS approach from Part 1 is more reliable because it cannot be changed in the browser.

YouTube Restricted Mode

YouTube Restricted Mode hides videos that have been flagged as inappropriate. It is not perfect — it relies on community flagging and automated classification — but it removes the worst content.

On any browser, scroll to the bottom of youtube.com and click Restricted Mode: Off to switch it on. On the YouTube app, go to Settings > General > Restricted Mode.

DNS-level enforcement (via NextDNS) is again more reliable because it forces restricted mode at the network level.

Block Browser Installation

On Windows, use Microsoft Family Safety's app restrictions to prevent the child from installing Chrome, Firefox, or other browsers that bypass Edge's content filtering. On macOS, use Screen Time's Content & Privacy Restrictions to prevent app installations. On ChromeOS, this is handled automatically — the child cannot install a browser that bypasses Chrome's filters.

On Linux, the child cannot install browsers without sudo access, so no extra configuration is needed.

Gaming Platform Controls

Games consoles and gaming platforms have their own parental control systems. These are separate from operating system controls and need to be configured individually.

Steam

Open the Steam client, go to Steam > Settings > Family. Steam Family View lets you restrict which games, store pages, and community features the child can access. Set a PIN that the child does not know.

Xbox (Microsoft)

Xbox parental controls are managed through the same Microsoft Family Safety dashboard used for Windows. Add the child's Xbox account to your family group and configure:

PlayStation

On the PlayStation console, go to Settings > Family Management > Parental Controls. Create a child account under your family manager account.

Nintendo Switch

On the Switch, download the Nintendo Switch Parental Controls app on your phone and link it to the console.

Summary

Every major platform has built-in parental controls. The core pattern is the same everywhere: create a separate child account, set screen time limits, enable content filtering, require your approval for app installations, and review activity regularly. The details vary by platform but the principles do not.

Windows uses Microsoft Family Safety, managed from a web dashboard. macOS and iOS use Screen Time, managed through Family Sharing. ChromeOS uses Google Family Link, managed from a phone app. Linux requires manual configuration with Timekpr-nExt for time limits, hosts file or DNS filtering for content, and browser policies for web controls. Gaming platforms each have their own parental control systems that need separate configuration.

The most important single action across all platforms is ensuring the child has their own account — never your admin account — and that private or incognito browsing is disabled. A child browsing privately bypasses every content filter except DNS-level filtering, which is why the network controls in Part 1 and the device controls in this guide work best together.