Are Parental Control Apps Worth the Privacy Sacrifice?

Parental control apps are installed on millions of kids' mobile devices. Their internet filters and privacy intrusions are accepted on safety grounds but how well do they actually work? We found that the most popular apps failed to filter the majority of risky websites we selected for our tests. They were also guilty of blocking recommended resources on sensitive subjects, such as sexuality and drug education.
Parental control apps investigation hero image. How well do their internet filters really work?
Simon Migliano
Christine O'Donnell
Simon Migliano & Christine O'Donnell

Internet Filtering: Parental Control Apps

12 Android apps with 14 million installs: we tested the effectiveness of internet filters in the most popular parental control apps in the Google Play Store.

Internet Filtering

  • In 70% of our tests parental control apps failed to filter internet content relating to extremism, misinformation, or platforms known for adult content outside of adult sites.
  • Microsoft’s parental control app failed 87% of our tests, allowing access to websites like OnlyFans, Gab, InfoWars, and Tinder.
  • Misinformation and extreme ideologies: parental control apps only blocked websites known for spreading misinformation and conspiracies in 10% of our tests. The apps only blocked websites with extreme ideological content in 27% of tests.

Overblocking

  • In 20% of our tests parental control apps blocked internet content on sensitive subjects from government-recommended websites.
  • Sex-ed and LGBTQ+ websites were the most commonly blocked, with all but one parental control app filtering at least one online resource relating to sexuality and sexual health.

YouTube, Messaging Controls

  • YouTube: Only two of the most popular parental control apps have dedicated alerts for high-risk YouTube search terms. The two apps only flagged around 20% of our test keywords.
  • Messaging: Again, only two parental control apps offered this functionality. The two apps only successfully flagged risky text in 27% of our tests.

Giving Up Privacy For Online Safety: Do Parental Control Apps Deliver?

It’s clear that unrestricted internet access can pose many risks for young people, especially now that over half of children own a smartphone.[1] From adult sites and grooming to health misinformation and other potentially radicalizing material, it’s little wonder that parents are worried about what their children are exposed to online.

Parental control apps sell themselves as a quick technological fix. Installed on both the parent and the child’s devices, this software allows parents to monitor their child’s internet activity and claims to filter inappropriate online content.

Internet filters are inherently intrusive and restrictive. For many people, however, this is a price worth paying to keep children safe online.

But do parental control apps actually work as well as they claim? Or is kids’ privacy being sacrificed for little real benefit?

We decided to find out by testing the effectiveness of the 12 most popular parental control apps in the Google Play Store which have over 14 million installs between them.

We particularly focused on how well the apps blocked access to websites featuring content relating to extreme ideologies, including racist and misogynistic materials; misinformation and conspiracy theories; and platforms known for adult content.

In 70% of our tests, the apps failed to filter this kind of high-risk online content.

We also looked at whether parental control apps were overblocking, i.e. inadvertently filtering content that should have been allowed. Our tests in this area focused on government-recommended websites on educational topics such as safe sex, substance abuse and mental health support.

In 20% of our tests, the parental control apps blocked access, which could have potentially devastating consequences for a young person looking for reliable information.

How Did We Test How Well The Apps Worked?

After installing each app on a pair of Android smartphones, we tested the effectiveness of their internet filters by trying to visit a hand-picked list of 23 risky websites. We selected the sites based on their potential real-world appeal and impact on young people.

See the full list of high-risk websites and the results of our tests.

To determine whether the apps were overblocking content, we tried to access 38 UK and U.S. government-recommended websites.

As well as internet filtering, some parental control apps offer additional means of monitoring and controlling internet activity.

Over a third of children watch YouTube regularly,[2] despite concerns over extreme content on the platform.[3] We therefore wanted to test how effective parental control apps were at filtering content on YouTube.

Only two apps, FamiSafe and Kaspersky SafeKids, offered dedicated YouTube alert/blocking functions beyond the Google SafeSearch standard protections. We tested these two apps using a list of inappropriate search terms.

Given the understandable parental fears around sexting[4], we also tested “suspicious text detection” features. Only two of the top 12 apps offered this highly intrusive feature: FamiSafe and MMGuardian. Our tests used a similar keyword list as the YouTube test.

Why Did We Do This Research?

Our mission is to defend against intrusions on digital privacy and to champion internet freedom. As such, we believe that decisions to censor internet content or intrude on individuals’ digital privacy should never be taken lightly and need very careful consideration in possession of all the facts.

This is particularly true when it comes to keeping children safe online. Surveilling and strictly controlling children’s internet activity using technology normalizes such behavior and does little to prepare them for responsible internet use as adults.

By providing evidence of how ineffective many of these parental control apps are at blocking anything outside of nudity and of the unintended side-effects of their content filtering, we hope that parents can make an informed choice about whether to use these apps or look to more hands-on ways to keep their children safe online.

App Features: Web Filtering

The following table shows the internet filtering capabilities offered by each of the 12 parental control apps included in this study.

Note: to be included, apps had to offer URL filtering.

* The Microsoft Family Safety app implements Bing Safe Search as a default search engine for the child’s device.

Allow/Denylist: is a customizable feature that allows the user to choose which websites may be accessed by the child or are blocked.

For a full list of the apps with details of their Google Play store listings, installs and developers, see this data sheet.

Findings: Web Filtering

To determine the effectiveness of parental control apps’ internet filters, we looked at both how well they blocked harmful internet content and whether they were sophisticated enough to allow access to important online resources on sensitive topics.

The results are listed below in a series of data tables, one for each category of website. If you don’t want to scroll through all that data, use the links below to skip ahead to the relevant section. The first three sets of results relate to underblocking, ie failures to block high-risk categories of website.

The next three sets of results relate to overblocking of categories of website that should be accessible.

Underblocking Findings: Failures to Block High-Risk Websites

Misinformation & Conspiracies

The following data table shows the app-by-app results of our internet filtering tests for high-risk websites in this category.

Parental controls apps are listed left-to-right across the top of the table and websites down the far-left column.

A result of Allowed means that that app’s internet filters failed to block access to that website. A result of Blocked means it was filtered successfully.

  • 90% failure rate: only 12 out of 120 of our tests for the misinformation and conspiracy category resulted in parental control apps successfully filtering this type of website.
  • 42% of apps failed completely: 5 out of 12 apps failed to block any of the risky websites in this category.
  • Most underblocked websites: InfoWars, Natural News, Epoch Times and Weather Action were not blocked at all.

Extreme Ideological Content

The following data table shows the app-by-app results of our internet filtering tests using far-right websites containing hateful content against minority groups. We’ve also included extreme misogynistic web content in this category.

Parental controls apps are listed left-to-right across the top of the table and websites down the far-left column.

A result of Allowed means that that app’s internet filters failed to block access to that website. A result of Blocked means it was filtered successfully.

  • 73% failure rate: only 26 out of 96 of our tests for the extremist content category resulted in parental control apps successfully filtering this type of website.
  • 2 apps failed completely: ScreenTime and FamiSafe failed to block any websites at all in this category.
  • Most underblocked website: the Britain First website was not filtered at all, despite its notoriety as a far-right, fascist site.

Adult Content

The following data table shows the app-by-app results of our internet filtering tests using websites with sexualized content other than adult sites. We also included dating platforms in this category, due to the potential for exposure to predatory individuals.

Parental controls apps are listed left-to-right across the top of the table and websites down the far-left column.

A result of Allowed means that that app’s internet filters failed to block access to that website. A result of Blocked means it was filtered successfully.

  • 27% failure rate: 44 out of 60 of our tests for the adult content category resulted in parental control apps successfully filtering this type of website.
  • Zero complete failures: 12 out of 12 apps blocked at least one of the adult websites. McAfee Safe Family, Microsoft Family Safe and FamiSafe had the worst performance in this category (60% fail rate).
  • Most underblocked website: Tinder was the least blocked site in this category. Internet filters in 7 apps failed to block very this well-known dating platform, despite its inappropriate nature.

Overblocking Findings: Preventing Access to Information Online

Sex-Ed

The following data table shows shows the app-by-app results of our internet filtering tests using U.S. and UK government-recommended sexual education or LGBTQ+ resources.

Parental controls apps are listed left-to-right across the top of the table and websites down the far-left column.

A result of Allowed means that the parental control app did not overblock and prevent access to that sex-ed website.

A result of Blocked means that the parental control app’s internet filters did erroneously block access to that website.

  • 28% overblocking rate: in 64 out of 228 tests, websites in the sex-ed category were wrongly blocked by the apps’ internet filters.
  • 92% of apps overblocked 11 out of 12 apps blocked at least one website in this category.
  • Worst individual overblocking rate: 74% ESET Parental Control and MMGuardian wrongly blocked the most websites in this category (14 out of 19 websites), followed by Norton Family Parental Control (44%).

Substance Abuse Education And Support

The following data table shows the app-by-app results of our internet filtering tests using U.S. and UK government-recommended substance abuse educational and support resources.

Parental controls apps are listed left-to-right across the top of the table and websites down the far-left column.

A result of Allowed means that the parental control app did not overblock and prevent access to that substance abuse educational website.

A result of Blocked means that the parental control app’s internet filters did erroneously block access to that website.

  • 17% overblocking rate: in 20 out of 120 tests, websites in substance abuse educational resource category were wrongly blocked by the apps’ internet filters.
  • 50% of apps overblocked: 6 out of 12 apps blocked at least one website in this category.
  • Worst overblocking performance – 70% KidsPlace wrongly blocked the most websites in this category (7 out of 10), followed by MMGuardian (50%) and FamiSafe (40%).

Mental Health Support

The following data table shows the app-by-app results of our internet filtering tests using U.S. and UK government-recommended mental health support websites.

Parental controls apps are listed left-to-right across the top of the table and websites down the far-left column.

A result of Allowed means that the parental control app did not overblock and prevent access to that mental health website.

A result of Blocked means that the parental control app’s internet filters did erroneously block access to that website.

  • 6% overblocking rate: 7 out of 108 of our tests of websites in the mental health support category were wrongly blocked by the apps’ internet filters.
  • 25% of apps overblocked: 3 out of 12 apps blocked at least one website in this category.
  • Worst overblocking performance – 56% Kids Place blocked the most mental health tests (5 out of 9 websites), followed by MMGuardian (11%). These were the only two apps that actively blocked websites in this category.
Screenshot of Kaspersky SafeKids block notification for LGBTQ website stonewall.org.uk

Screenshot of parent notification on the Kaspersky SafeKids app after a child tries to access a blocked LGBTQ+ website.

In a significant intrusion of privacy, most of the apps instantly notify parents with details of individual blocked websites a child has tried to access. There are potentially serious implications from such breaches of privacy, with just one example above being the consequences for a young person whose parents discover they are seeking online support for issues around their sexuality.

App Features: YouTube Filtering

The following table displays each of the apps’ YouTube filtering and monitoring features.

Note: We only tested FamiSafe and Kaspersky Safekids for YouTube alerts and YouTube filtering as those were the only apps that offered these functions. The other 10 apps only provided YouTube search history monitoring, and therefore were excluded.

  • YouTube Monitoring: allows monitoring of a child’s YouTube search history.
  • YouTube Alerts: sends an alert notification when a high-risk YouTube search has been detected on the child’s device.
  • YouTube Filtering: blocks access to risky YouTube searches altogether, instead of just flagging it.
  • YouTube Restricted Mode: similar to ‘Google Safe Search’, this is a YouTube setting rather than a parental control app function that hides adult content.

Findings: YouTube Filtering

Underblocking YouTube Searches

The data table below shows which high-risk YouTube searches were either flagged or blocked by FamiSafe and Kaspersky Safekids.

The table also shows how the apps categorized each blocked/flagged search term.

  • 79% failure rate: only 11 out of 52 high-risk YouTube search tests resulted in a block or flag by FamiSafe and Kaspersky SafeKids.
  • FamiSafe 81% underblocking rate: the app allowed 21 out of 26 high-risk searches through its content filters, including terms such as “terrorism”, “ISIS” and “KKK”.
  • Kaspersky 77% underblocking rate: the app allowed through 20 out of 26 risky searches.

Overblocking YouTube Searches

The data table below shows which YouTube search terms on sensitive topics were wrongly blocked or flagged by FamiSafe and Kaspersky SafeKids.

The table also shows how the apps categorized each blocked/flagged search term.

*Incorrect categorization by the app

  • 39% overblocking rate: 11 out of 28 searches were wrongly blocked by the apps’ filters.
  • Kaspersky SafeKids: was the worst offender. It blocked 8 out of 14 (57%) of our test searches.

App Features: Messaging Controls

The following table shows the messaging controls offered by each parental control app.

Note: Out of the 12 apps, only MMGuardian and FamiSafe offered suspicious text detection alerts for social media messaging. We therefore focused our tests on those two apps in this section.

  • Message Monitoring: allows monitoring of every message sent and received by a child via social media messaging.
  • Suspicious Text Alert: sends an alert when a “suspicious” message has been sent or received by the child.
  • Contact Blocking: allows blocking of any contact on a child’s device, preventing incoming calls or messages from this contact.

Findings: Messaging Controls

Underblocking Messages

The data table below shows the words that MMGuardian and FamiSafe’s “suspicious text” detection feature failed to flag. For the words that were successfully detected, the reason for the alert is also stated.

  • 75% failure rate: Only 14 out of 56 tests involving a risky keyword triggered an alert.

Overblocking Messages

The following data table shows the wrongly-categorized “suspicious texts” detected by MMGuardian and FamiSafe along with the filter category assigned to each word.

  • 18% overblocking rate: 5 out of 28 test messages involving non-risky keywords triggered an unnecessary alert.

How Internet Filters Work

Parental control software relies on internet filters to prevent children from accessing inappropriate content on their device.

Internet filters work in fundamentally the same way whether they are being used to censor the internet for a whole country or on an individual device. They are a set of rules that determine what an end-user is able to access when they connect to the internet.

Unlike internet filtering carried out by Internet Service Providers or network administrators at a school or workplace, parental control apps are client-side filters.

Many parental control apps also use search-engine filters to filter out inappropriate links from search results.

Internet filters that rely on third-parties, such as ISP content filtering and parental control apps, are particularly prone to the kinds of issues identified in this research report. This is due to the “black box” nature of server-side management of the filters.

Allowlist / Blocklist

An allowlist is a mechanism used to explicitly allow access only to those entities on the list, ie a list of permitted URLs or apps. Nothing else can be accessed, unless it is added to the allowlist.

In parental control apps, allowlists are fully managed via the app settings.

A blocklist works in the opposite way, ie it is a list of apps and websites that may not be accessed. Anything not on the blocklist is accessible by default.

Blocklists will typically be a combination of server-side lists managed by the service provider. Some apps allow the end user to add to the blocklist. A blocklist is inherently less specific and can contain the following types of entity:

  • URLs: this allows blocking of specific websites. This is highly targeted and is less likely to result in underblocking or overblocking.
  • Categories: allows filtering of entire categories of websites, such as gambling or adult content. Miscategorization of sites often leads to filtering errors.
  • Keywords: blocks sites containing words like “sex” or “drugs”. This crude method of internet filtering typically leads to significant overblocking. It can also miss less obvious high-risk content.

How To Bypass Internet Filters

Internet filters are by no means foolproof and there are many options for bypassing content restrictions. Below are some of the most effective methods, depending on the type of the internet filter in place.

VPN

A Virtual Private Network (VPN) encrypts a user’s internet connection and changes their visible IP address, which makes it particularly effective at bypassing internet filters, as long as the filters are not installed on the device itself. This means a VPN won’t work against parental control mobile apps.

Web Proxies

Web proxies allow a user to route web pages through a middleman website, with the website content loaded in a wrapper. This fools blocklists, as the blocked URL is not being visited directly. Free web proxies are not recommended however as they pose a significant privacy and security risk, due to the opportunity for content manipulation and the lack of encryption.

Guess The Password

Young people whose parents are less tech savvy than they are and who reuse obvious passwords have a good chance of being able to guess or brute force the password of a parental control app and disable any internet filters.

Clear Parental Controls

It is possible to reset some parental control apps by going into the device settings and choosing the clear data and storage option.

Factory Reset

The nuclear option. A young person desperate to bypass the internet filters on their device may well think it’s worth wiping all their apps and data given that it will also remove the parental control app in the process.

Methodology

We analyzed the 12 most popular parental control apps on the Google Play Store. Using a pair of test devices, the web filtering capabilities of each was tested using a list of 23 high-risk URLs and a list of 38 UK and U.S. government-recommended websites.

We tested YouTube alert and blocking functions on apps that provided this capability, namely FamiSafe and Kaspersky SafeKids. We used two lists of search terms, one of high-risk terms and another of terms related to genuine searches for information on sensitive topics.

We also tested FamiSafe and MMGuardian “suspicious text detection” on social media messaging. This was based on a similar keyword list as used in the YouTube tests.

Results of allowed, flagged or blocked words were recorded for all of the above tests as well as the filter category, if provided.

References

[1] https://www.npr.org/2019/10/31/774838891/its-a-smartphone-life-more-than-half-of-u-s-children-now-have-one

[2] https://www.pewresearch.org/internet/2018/11/07/many-turn-to-youtube-for-childrens-content-news-how-to-lessons/

[3] https://theconversation.com/youtubes-algorithms-might-radicalise-people-but-the-real-problem-is-weve-no-idea-how-they-work-129955

[4] https://www.plannedparenthood.org/learn/teens/bullying-safety-privacy/all-about-sexting