Device-Level Parental Controls: What They Can and Cannot See Inside Apps

What device-level parental controls actually are

Device-level parental controls are settings provided through an operating system, family account or device management service. They allow a parent or guardian to manage certain aspects of a child's digital environment without needing to operate every individual app. Common functions include setting time limits, restricting downloads, filtering content and managing access to selected applications.

Apple provides parental controls through Screen Time and its Content & Privacy Restrictions. Google offers family supervision features through Family Link on supported accounts and devices. The exact settings differ, but both approaches place an important part of the control mechanism outside the individual app.

This distinction matters when explaining what a parent can see. A device management service may know that an app was used or that a time limit was reached. That information is not equivalent to knowing what the child typed into an AI companion, which messages were exchanged or what a particular conversation contained.

• Manage access to selected applications.
• Set screen-time limits and schedules.
• Restrict certain downloads and purchases.
• Apply content filters and account supervision settings.

App ratings provide one layer of access control

App store age ratings provide a classification that device settings can use when deciding which applications a child may download or access. Apple currently uses 4+, 9+, 13+, 16+ and 18+ categories. Google Play uses regional rating authorities, including PEGI across European markets and ESRB in the Americas.

The different systems matter because their categories are not directly interchangeable. For example, PEGI 16 and ESRB Mature 17+ are not identical classifications. Parents should look at the rating displayed in the relevant regional store and understand what that particular label describes.

An age rating is an assessment of an app's suitability under the applicable classification system. It does not tell a parent whether a specific user has completed an age check. It also does not provide a complete description of every interaction or feature available after installation.

• Apple: age-based app restrictions through Screen Time.
• Google Play: ratings and filters within supported family settings.
• Regional classifications: different systems may use different thresholds.
• Service restrictions: an app can also set its own minimum age.

What parents can usually manage

The most useful device-level controls concern access and usage. Depending on the platform and configuration, parents can approve downloads, restrict applications, set daily limits and establish periods when a device or selected apps should be unavailable. Some settings also cover purchases, web browsing, communication features and other categories of content.

Apple's support documentation describes content restrictions for apps, media and device settings. Its developer frameworks also allow compatible apps to request authorisation for certain parental control experiences. Google's Family Link documentation describes account supervision, app management and screen-time features for supported Android and ChromeOS devices.

For example, a parent might configure an age-rating restriction, require approval for a new app and set a daily usage limit. Those controls address whether the child can access the app and how long it can be used. They do not automatically provide a transcript of the child's activity inside it.

• Application installation and approval.
• Time limits and scheduled downtime.
• Selected website and content restrictions.
• Certain purchase and account settings.
• Usage information where the platform provides it.

What device controls cannot automatically see

An operating system generally does not have unrestricted access to every private interaction inside every installed application. An app may store its own conversations, generate content on its servers or process interactions through an external service. A device-level parental control does not automatically reveal those details simply because it can restrict the app's use.

Consider a child who opens an AI companion application for 20 minutes. A family management tool may provide information about app usage or apply a time restriction. That does not necessarily mean the parent can see the prompts entered, the AI responses, the character selected or the content of individual exchanges.

The same distinction applies to other services. Messaging, social networking, games and streaming applications may have their own reporting and supervision features. The information available to parents depends on the app's design, account permissions, platform capabilities and privacy settings.

• Private conversation transcripts are not automatically visible.
• AI prompts and generated responses are not automatically exposed.
• App-specific account activity may remain within the service.
• A usage report does not necessarily explain the content viewed.

The role of in-app parental controls and child-appropriate design

Device-level settings are only one part of a wider approach to child safety. An application may provide its own parental controls, age-specific settings, content filters, communication restrictions and reporting tools. These controls operate within the service and can address experiences that an operating system cannot directly manage.

The UK's Age Appropriate Design Code, published by the Information Commissioner's Office, provides a broader framework for services likely to be accessed by children. Its 15 standards address matters including the best interests of the child, age-appropriate application, data minimisation, transparency, parental controls, profiling and geolocation. The Code expects services to consider children's rights and privacy when designing their products.

The Code also addresses age assurance. Its approach is risk-based: services should establish the age of child users with a level of certainty appropriate to the risks created by their data processing, or apply the Code's protections to all users. This is a responsibility of the service, separate from a parent's decision to enable device restrictions.

• Device controls: manage access and selected usage settings.
• In-app controls: manage features and experiences within a service.
• Age assurance: supports age-appropriate decisions by the service.
• Privacy settings: determine how children's information is handled.

Why the layers do not replace one another

A store rating, a device restriction and an in-app parental control answer different questions. A rating describes the suitability of the application. A device restriction determines whether an account or device can access it under selected settings. An in-app control manages selected activities or features once the service is being used.

For example, a parent may block an app rated 18+ on a child's device. If the app is accessed through a separate browser or another device, the original restriction may not cover that route. Similarly, an app may have an adult-only policy but still need its own method for deciding whether a particular user meets that requirement.

Families should therefore avoid treating one setting as a complete account of a child's online experience. Product teams should explain the precise scope of their own controls and avoid suggesting that a device-level setting can monitor content that the operating system does not expose.

A practical way to review the available controls

Start by identifying the device and account being supervised. Check which family management features are supported, which applications are covered and whether the child can use another device or account. Then review the app's store rating, its own age restriction and any parental settings available inside the service.

For parents, the next useful step is to open the relevant family settings and record three things: which apps are restricted, what usage information is visible and which controls require action inside the app itself. For product teams, the equivalent exercise is to document what their service exposes to parents, what remains private and how those features interact with operating-system restrictions.

• Identify the child's device, operating system and supervised account.
• Review the applicable app store age rating.
• Check installation, usage and content restrictions.
• Read the app's own parental control documentation.
• Record which activities are visible and which are not.

Questions readers ask