Play, AppGallery, sideloading, and where the controls stop

A parent who has set up Family Link sees the Play Store.

A child who has a Samsung Galaxy Store, a Huawei AppGallery, a Xiaomi GetApps, a third-party app store, or a friend with an APK file sees six more paths.

This page documents the install paths on Android and which part of the configuration covers each one.

The article is the install-side counterpart to Play Store purchases and approvals. The purchase article documents the spend side; this article documents the install side.

Definition

A research-grounded inventory of the ways an app can land on an Android device, paired with the part of the parent-side configuration that covers each path.

The setup article assumes the controls cover the only install path. They do not. The six documented install paths vary in the level of reach the parent-side configuration has.

Scope

The page covers the install surface on Android phones and tablets, with the parent-side Family Link surface on Google Mobile Services devices, the Samsung Galaxy Store, the Huawei AppGallery, the Xiaomi GetApps store, and the standard Android sideloading, Developer Options, and bootloader-unlock paths.

It does not cover the iOS or Apple-Family-Sharing side. It does not cover web-based downloads. The article is about the install surface, not the network surface.

The six documented paths

The install paths on a typical Android device:

1. Play Store. The Google Play Store on a Google Mobile Services device. Family Link gates content, app allowance, and purchase approval.
2. OEM app store. Samsung Galaxy Store, Xiaomi GetApps, OnePlus Store, and similar pre-installed OEM stores. Each store has its own restriction mechanism.
3. AppGallery. Huawei’s documented store on post-Google Huawei devices. AppGallery carries its own access restrictions.
4. Sideloading. The standard Android mechanism for installing an APK from outside the device’s stores. The setting is in the Android settings.
5. Developer options and ADB. An advanced path that requires enabling Developer Options and connecting the device to a computer.
6. Bootloader unlock and custom ROM. The hardest path, requiring an OEM-provided bootloader unlock and a custom recovery image.

The parent-side controls reach the first path. The remaining paths are documented in this article, with the documented scope of each control.

Play Store

The Play Store is the path Family Link covers.

Family Link on the parent-side drawer exposes:

• The maturity rating ceiling for downloads. [source: google-family-link-play-content].
• The purchase approval flow. [source: google-family-link-purchase-approval].
• The allowed-apps list under the parent-side controls.

The Play content ceiling does not block restricted content from appearing in a search result or through a direct link [source: google-family-link-play-content]. Apps downloaded before the restriction was set may remain visible.

The UI key for the Play Store controls is google.familylink.play_store.

OEM app stores

Samsung, Xiaomi, OnePlus, and other Android OEMs ship their own app stores on top of the Play Store. Each store has its own restriction mechanism.

Samsung Galaxy Store

Samsung documents Samsung Kids as a child-zone launcher that includes its own app selection [source: samsung-kids]. The web-browser allowance is inside Samsung’s own browser, not a universal browser control.

The parent who sets up Family Link has not enabled the Galaxy Store restrictions. The Galaxy Store is a separate configuration step.

Xiaomi GetApps

Xiaomi documents the parental-controls entry as model-dependent [source: xiaomi-controls]. The same parent may read two different menus on two different Xiaomi phones.

The wave-0 research packet does not establish a separate Xiaomi store restriction. The OEM-store path is a separate configuration step.

AppGallery

Huawei’s AppGallery is the only documented store on post-Google Huawei devices. AppGallery’s Access restrictions row governs age-rated installation restrictions [source: huawei-appgallery].

The UI key is android.settings.huawei.appgallery.

AppGallery’s restrictions are AppGallery-only. The page does not document Google Play parity, because Google Play is not installed on the device.

A parent who has set up Family Link on a non-Huawei device has not enabled AppGallery’s restrictions on a Huawei device. The two surfaces are not connected.

Sideloading

“Install unknown apps” is the Android setting that governs installing an APK from outside the device’s stores. The setting is in the Android settings under Security or Apps, depending on the Android version.

The setting is not a Family Link setting. The parent who has set up Family Link has not set the device setting. The child can sideload an APK if the device setting allows it.

The setting is per-app. A parent who has blocked one sideload source has not blocked all of them.

Developer options and ADB

Developer Options is a hidden menu on Android. The entry is reached by tapping Build number seven times. The setting is documented in the wave-0 research packet at android.settings.developer_options with the entry held as unverified in the resource.

Once Developer Options is enabled and a PC is connected via USB, the device can be controlled by the Android Debug Bridge (adb). The recovery path on a non-A/B device includes adb sideload [source: source-android-recovery-adb-sideload].

The Android 17 Compatibility Definition documents Developer Options as a standard device surface [source: source-android-cdd17-dev-options]. The CDD does not document a parent-side restriction on Developer Options.

The path is for advanced users. The child-side reach is the parent’s responsibility; the documented control is the parent-side screen lock.

Bootloader unlock and custom ROM

The bootloader is the first code that runs on the device. The Android source documents the bootloader locking and unlocking mechanism [source: source-android-bootloader-unlock].

A bootloader unlock allows the device to boot a different operating system image. The new image can include a different set of parental controls or none at all.

The path is for advanced users. The device-side mitigation is the parent-side screen lock and the parent-side account credentials.

What the parent-side Family Link does not reach

The parent-side Family Link drawer documents the Play Store layer. The other five paths are documented as separate configuration steps.

• OEM app stores. Samsung, Xiaomi, OnePlus, and similar vendors ship their own stores. Each store has its own restriction mechanism.
• AppGallery. Huawei’s post-Google store carries its own access restrictions.
• Sideloading. The Android setting that governs installing an APK from outside the stores.
• Developer options and ADB. A standard Android surface for connecting to a computer.
• Bootloader unlock. The first code that runs on the device.

A parent who treats the Play Store as the only install path is making an assumption the device does not enforce.

What the parent can do

The parent has a small number of documented levers.

1. Set the parent-side screen lock

The parent-side screen lock is the device-level mitigation. The child who reaches the Settings app cannot enable Developer Options or change the sideloading setting without the parent-side screen lock.

2. Disable Developer Options on the child device

The Developer Options menu can be hidden or its access restricted by the parent. The exact setting is OEM- dependent. The parent who treats the setting as universal is making an assumption the device does not enforce.

3. Enable sideload restrictions

The “Install unknown apps” setting is per-app. The parent who enables the restriction for one app (the browser, the file manager) has not enabled it for the other apps.

4. Set the parent-side account credentials

The parent-side account credentials, including the parent-side Google account, are a separate layer from the child-side account. The parent who has the parent- side account credentials can re-establish the configuration after a factory reset.

5. Talk about it

The conversation about which install paths exist is a relationship decision. The configuration protects the device; the conversation protects the relationship. Both are needed.

What this article does not cover

The article above documents the six install paths and the documented scope of each control. It does not cover:

• Whether a specific Samsung Galaxy Store version exposes a per-app restriction. Samsung’s own page is the source.
• Whether a specific Xiaomi HyperOS version exposes the same Digital Wellbeing path as the cited 14T Pro [source: xiaomi-controls].
• Whether a specific Huawei ID child account applies in DE / AT / CH. The cited Huawei page is the source.
• The full AOSP source-resource strings for Settings entries not on the vendor support pages. The wave-0 research packet did not transcribe them [source: android-aosp-settings].

The configuration protects the conversation. The conversation protects the relationship. Both are needed.

Sources

• google-family-link-play-content — Google Families Help, “Set up content restrictions on Google Play”. The maturity-rating ceiling and the direct-link / search-result boundary [source: google-family-link-play-content].

• google-family-link-purchase-approval — Google Families Help, “Purchase approvals on Google Play”. The Play-billing-only scope [source: google-family-link-purchase-approval].

• google-multiuser — Google Kids Space Help, “Add users to a device”. The profile boundary [source: google-multiuser].

• source-android-cdd17-dev-options — Android 17 Compatibility Definition. The standard Developer Options surface [source: source-android-cdd17-dev-options].

• source-android-bootloader-unlock — Android Source, “Locking and unlocking the bootloader”. The first-code-on-device documentation [source: source-android-bootloader-unlock].

• source-android-recovery-adb-sideload — Android Source, “Non-A/B system updates: recovery device code”. The adb sideload recovery path [source: source-android-recovery-adb-sideload].

• huawei-appgallery — Huawei Support, “Introduction to the Access restrictions function in HUAWEI AppGallery”. The AppGallery-only restriction [source: huawei-appgallery].

• samsung-kids — Samsung Support, “Samsung Kids on your Galaxy phone or tablet”. The child-zone launcher [source: samsung-kids].

• xiaomi-controls — Xiaomi Support FAQ, “How to turn on Parental controls on the Xiaomi smartphone”. The model-dependent path [source: xiaomi-controls].

• huawei-privatespace — Huawei Support, “Does my HUAWEI phone/tablet support PrivateSpace”. The PrivateSpace / Digital Balance interaction [source: huawei-privatespace].

• android-aosp-settings — AOSP, Settings resource repository. The source-string resource [source: android-aosp-settings].