What actually works instead of blocking

The previous article in this wiki explains why blocking an app icon does not block the service behind it.

This page is the constructive side of the same question.

It is ordered by effectiveness, not by which is easiest to set up.

The four steps that hold, in order, are:

1. Lock the account, not the app.
2. Block the money, not the content.
3. Set the age in the service, not on the device.
4. Manage the device account, not the device.

Each step is a different layer.

A household that has done all four is in a much stronger position than one that has only hidden an icon [source: roblox-pc] [source: apple-ask-en] [source: google-family-link-getting-started].

A household that has done only the first two is in a stronger position than one that has only hidden an icon.

The per-service setup is in Settings inside the apps.

This page is the order to do them in, and why.

Prerequisites

A few things must be true before the steps below are useful.

Without them, the steps apply, but the lock does not.

• A child account that the parent has access to, on each service the child uses. Roblox, WhatsApp, Instagram, TikTok, Discord, and YouTube each have their own account surface. The setup below names the relevant surface per service.

• A parent account on the same service, with the relevant app installed on the parent’s device. Several surfaces — Roblox, WhatsApp, Fortnite, ChatGPT, Meta — require the parent to have an account on the service [source: roblox-pc] [source: whatsapp-pma3] [source: epic-cabined] [source: help-chatgpt-faq]. The parent walks through a consent flow on their own device.

• A managed device account, on the operating system the child uses. Screen Time, Family Link, and Microsoft Family Safety each travel with the device account, not the device hardware [source: apple-screen-time] [source: google-family-link-getting-started] [source: microsoft-ms-family-safety]. A child with their own, unmanaged device account is outside these surfaces.

• A willingness to revisit the setup after app updates. The settings-inside-the-apps article documents the diagnostic order for a setting that “disappeared after an update” [source: wirecutter-parental-controls].

• The in-app control, not the network filter, for the service the child is on. A network filter regulates the network, not the account [source: wirecutter-parental-controls]. The steps below are about the account.

If those are not in place yet, work through the linked articles first.

What follows assumes them.

Steps

1. Lock the account, not the app

This is the single most effective step in the article.

It is also the most often skipped.

A block on the app icon prevents one front end from running on one device.

A lock on the account prevents the service from working on the account. This applies regardless of which front end the child uses.

The pattern looks like this on each of the services this wiki covers.

• Roblox. Roblox’s parental controls are configured on the parent-privilege account [source: roblox-pc]. The parent verifies their own age on the Roblox site using a government ID or a credit-card check. The settings live in Settings → Parental Controls. They have sub-panels for content maturity and monthly spend [source: roblox-parental-controls-overview]. A block on the Roblox app icon does not touch the parent-privilege account. The account remains open on the web and on every device the child signs into.

• WhatsApp. WhatsApp’s parent-managed accounts are configured on the child’s account [source: whatsapp-pma1] [source: whatsapp-pma3]. The parent scans a QR code on the parent’s device and sets a 6-digit PIN. The PIN gates the privacy and contact settings on the account. The child cannot change them without the parent. The setting is in More options → Create a parent-managed account (app.whatsapp.parent_managed_setup). A block on the WhatsApp app icon does not gate the account on the web.

• Discord. Discord’s Family Center is configured by the teen, on the teen’s mobile app, via a QR-code scan on the parent’s device [source: discord-fc-eng]. The parent’s view is an activity feed of servers joined, new friends, and time spent [source: discord-fc1]. A block on the Discord app icon does not gate the Discord account on the web. The link is opt-in on the teen’s side. The article is honest about that.

• TikTok. TikTok’s Family Pairing is a two-sided link [source: tiktok-family-pairing]. Either party initiates and the other confirms. A parent can set screen-time, restricted mode, DM, and search rules from the parent side. A block on the TikTok app icon does not gate the TikTok account on the web.

• YouTube (supervised account). A supervised YouTube account attaches the content setting to the account, in Family Center (You → Settings → Family Center) [source: google-yt-supervised]. The setting travels with the account, on the app and on the web, as long as the supervised account is signed in. A block on the YouTube app icon does not gate the signed-out web view. That is a separate problem documented in the article on embedded video.

The order of effectiveness within this step is the order above, roughly.

The account lock that travels the furthest is the one bound to the most devices the child actually uses.

2. Block the money, not the content

A block on spending is the second strongest lever a household has.

Most services keep the money path separate from the content path.

Three places the money goes, in order of how often they slip past a content block.

• In-app purchase approval. Both Apple and Google have approval flows. They require a parent to authorise every in-app purchase from the child’s account. Apple’s flow is Ask to Buy. It is configured on the family organiser’s device (Settings → Family) [source: apple-ask-en] [source: apple-family-kids]. Google’s flow is Purchase approvals. It is configured inside the family manager’s Google Play settings (Google Play) [source: google-approvals-en] [source: google-family-link-purchase-approval]. Neither flow requires a block on the app. Both attach to the account.

• Gift-card top-up. Gift cards add money to a balance without going through the in-app purchase approval flow. Roblox states explicitly that monthly spending limits do not cover gift-card redemptions [source: roblox-monthly-spending]. The remedy is household policy on gift cards, kept in a drawer or a wallet, not a service setting.

• Console store spend. A console store is a separate service from the phone. It includes PlayStation, Xbox, Nintendo Switch, and Steam. Roblox also documents that monthly spending limits on the platform do not cover spending through the Xbox store [source: roblox-monthly-spending]. The remedy is a separate purchase-approval flow on the console, in Settings for Xbox [source: microsoft-ms-limits-en], in the PlayStation family settings [source: playstation-ps-family-en], or in the corresponding store on Switch or Steam.

The order of effectiveness is: in-app purchase approval first, then household policy on gift cards, then console-store settings.

The reason: the in-app approval attaches to the account. The gift-card and console-store settings are separate bills the household decides about.

3. Set the age in the service, not on the device

The age that matters is the age the service holds for the child’s account.

It is not the age the household happens to be.

Several services change the experience when the account says the user is under 13, under 16, or under 18.

• TikTok allows under-13 accounts in a younger mode with reduced features. It allows 13-to-17 accounts in a teen mode with the family surface available [source: tiktok-family-pairing].

• Instagram flags accounts whose birthday entered at signup falls in the 13-to-17 range as Teen Accounts. Default private + restricted DMs + sleep mode 22:00-07:00 + a 60-minute daily reminder. Content filtering “inspired by” 13+ ratings [source: meta-teen2].

• YouTube (supervised account) sets a content level on the supervised account. It has three documented levels (Explore / Explore more / Most of YouTube) plus an Approved Content Only mode for the youngest band [source: google-yt-supervised].

• Roblox applies different content-maturity levels depending on the age on the account, with an under-13 default [source: roblox-pc]. Roblox also documents that under-13 accounts cannot self-edit the birthdate. Accounts registered as 13+ can [source: roblox-age-en] [source: roblox-age-de].

• Xbox uses the birthdate on the Microsoft account to gate content ratings, multiplayer permissions, and spending approvals [source: support-xbox-age-en] [source: microsoft-ms-age-en].

A false birthdate is the most common reason an age-based control does not apply.

The remedy is the same: enter the right birthdate when the account is set up, and not later.

The order of effectiveness within this step is the order above.

The service with the most documented age-sensitive behaviour for the child’s age band should be done first.

4. Manage the device account, not the device

A device lock is a setting on one piece of hardware.

A device-account lock is a setting that travels with the Apple Account, the Google Account, or the Microsoft account.

The second is the stronger of the two. The child’s next device, the friend’s device, and the school device are all signed into an account, not a piece of hardware.

• iPhone, iPad. The relevant surface is Screen Time on a child Apple Account inside Family Sharing [source: apple-screen-time]. The path is Settings → Screen Time on the parent’s device, with the child account under Family. The lock is the Screen Time passcode, which is separate from the device passcode [source: apple-screen-time].

• Android phone or tablet. The relevant surface is Family Link on a supervised Google Account [source: google-family-link-getting-started]. The path is Family Link on the parent’s device, with app limits, content filters, and device-level screen time set per child.

• Xbox console and Microsoft-account games (Minecraft, Fortnite on Xbox). The relevant surface is Microsoft Family Safety on a child Microsoft account inside the parent’s family group [source: microsoft-ms-family-safety]. The path is Settings on the parent’s account at account.microsoft.com/family.

• PlayStation console. The relevant surface is Family Management on a child PSN account under the parent’s account [source: playstation-ps-family-en].

• Nintendo Switch. The relevant surface is Parental Controls on the Switch, paired with a parent-side smartphone app.

• Steam (PC gaming). The relevant surface is Steam Families, on a child Steam account inside the parent’s family group [source: help-steam-families-en].

The order of effectiveness within this step is the order above: Apple and Google first, then the console the child actually uses.

A household with only one device is in a strong position.

A household with four devices that all have a separate, unmanaged account is in a weak position even if every device has a “lock” on it.

What these steps do not cover

The four steps above are the documented levers a household has.

They are not comprehensive.

Three things the steps above do not cover.

They do not cover a service the company does not control.

Signal and Telegram have no parent-facing surface of any kind [source: support-signal-gdpr] [source: support-signal-gdpr-de] [source: telegram-wales].

The remedy for these is the household conversation and a device-level limit on the network or the screen, not a service-level setting.

They do not cover an account on a device the parent does not manage.

A friend’s phone, a school iPad that is not in the family group, and a console on a different account are all outside the surfaces above [source: wirecutter-parental-controls].

The remedy is a household rule on which devices the child is allowed to use, and at what ages.

They do not cover a service the child has re-signed into under a new account, with a false birthdate.

The account lock, the payment block, and the age setting all attach to one account.

A second account, signed up under a different name and a different birthdate, starts outside the lock [source: roblox-pc] [source: character-charai-safety].

The remedy is the same: a household rule, and a device-level block on creating a new account under a false birthdate, where the operating system offers one.

If a step does not stick

Each of the four steps has a known failure mode.

The diagnostic order is the same as the order of effectiveness.

1. The account lock did not take. Roblox’s parent-privilege account is not active until the parent verifies their own age [source: roblox-pc] [source: whatsapp-pma3] [source: epic-cabined]. The same is true for the WhatsApp QR-code flow and the Epic cabined-account consent flow. The verification step is what creates the lock. The settings screen is what the lock controls.

2. The money is still going out. The in-app purchase approval is a separate setting from the app icon [source: roblox-monthly-spending] [source: apple-iap-en] [source: microsoft-ms-limits-en]. The gift-card path is a separate setting from the in-app purchase. The console store is a separate setting from both. Walk through the three places money goes, in that order, and check each.

3. The age is wrong on the account. Several services allow the user to change a birthday that was set in the past [source: roblox-age-en] [source: google-family-link-age-transition]. A wrong birthday on the account is the most common reason an age-based control did not apply. The reason is the user-entered value, not the household’s belief.

4. The device account is not the one being managed. A child with a second Apple Account, a second Google Account, or a second Microsoft account is outside the household’s managed surface [source: apple-family-kids] [source: google-family-link-supervision]. The remedy is the household rule on which account the child is allowed to sign into on which device.

The settings-inside-the-apps article walks through the diagnostic for a setting that “disappeared after an update”.

That diagnostic and the one above share the same logic: the lock is on the account, and the account is the unit of management.

Talking about it

A household that has done the four steps is, in the documented behaviour of the services, in a stronger position than one that has hidden an icon.

A household that has done the four steps has not solved the problem of the child’s next app, the friend’s phone, or the school device.

The conversation is the layer that holds when the technical layer does not.

The US FTC and the Austrian Safer Internet Centre both treat parental controls as one layer. They treat the conversation as the layer that travels with the child [source: consumer-ftc-parental-controls] [source: saferinternet-technischer-kinderschutz].

The four steps are most useful when the child can name them.

A child who can name the household rule, the parent-privilege account, the gift-card policy, and the device account has something the parent can refer to later, in a sentence that is not I do not trust you.

A child who can name none of those hears the rule as an accusation, and works to undo it.

Sources

• roblox-pc — Roblox Support, Parental Controls FAQ. Primary source for the parent-privilege account and the age-verification requirement [source: roblox-pc].
• roblox-monthly-spending — Roblox Support, monthly-spending documentation. Primary source for the gift-card and Xbox-store exclusions [source: roblox-monthly-spending].
• roblox-age-en — Roblox Support, How do I change my age? (EN). Primary source for the under-13 cannot self-edit rule [source: roblox-age-en].
• roblox-age-de — Roblox Support, Wie ändere ich mein Alter? (DE). Native German confirmation [source: roblox-age-de].
• roblox-parental-controls-overview — Roblox Support, parental-controls overview. Primary source for the maturity-level setting and the second-account gap [source: roblox-parental-controls-overview].
• discord-fc1 — Discord, Discord Family Center – Safety. Primary source for the activity-feed scope and the metadata framing [source: discord-fc1].
• discord-fc-eng — Discord Support, Family Center for Parents and Guardians (EN). Primary source for the QR-code-scan setup requirement [source: discord-fc-eng].
• tiktok-family-pairing — TikTok Support, Family Pairing. Primary source for the two-sided setup and the account-level scope [source: tiktok-family-pairing].
• google-yt-supervised — Google Support, Parental controls & settings for supervised kid accounts on YouTube. Primary source for the supervised-account content setting and its app-and-web scope [source: google-yt-supervised].
• google-youtube-options — Google Support, YouTube options. Primary source for the Restricted Mode toggle and the supervised-account graduation rules [source: google-youtube-options].
• google-play-child-account — Google Play Help, Google Play & your child’s Google Account. Primary source for the per-app content and purchase settings on the child account [source: google-play-child-account].
• google-play-content — Google Play Help, content restrictions documentation. Primary source for the content-level settings [source: google-play-content].
• google-approvals-en — Google Play Help, Purchase approvals (EN). Primary source for the purchase-approval flow on Google Play [source: google-approvals-en].
• google-payment-en — Google Play Help, Payment methods (EN). Primary source for the family payment method [source: google-payment-en].
• google-family-link-getting-started — Google Families Help, Get started with Family Link. Primary source for the family-manager setup [source: google-family-link-getting-started].
• google-family-link-supervision — Google Families Help, supervision documentation. Primary source for the supervised-account scope [source: google-family-link-supervision].
• google-family-link-purchase-approval — Google Families Help, purchase-approval documentation. Primary source for the family-side purchase approval [source: google-family-link-purchase-approval].
• apple-screen-time — Apple Support, Screen Time. Primary source for the account-travelling nature of the Screen Time passcode [source: apple-screen-time].
• apple-ask-en — Apple Support, Ask to Buy (EN). Primary source for the family-organiser approval flow [source: apple-ask-en].
• apple-iap-en — Apple Support, In-app purchases (EN). Primary source for the in-app purchase path [source: apple-iap-en].
• apple-family-sharing — Apple Support, Family Sharing. Primary source for the family group [source: apple-family-sharing].
• apple-family-kids — Apple Support, Family Sharing and Apple Account for children. Primary source for the child Apple Account rules [source: apple-family-kids].
• apple-refund-en — Apple Support, Request a refund (EN). Primary source for the refund path on in-app purchases [source: apple-refund-en].
• whatsapp-pma1 — WhatsApp Help Center, Parent-Managed Accounts. Primary source for the account-level scope and the under-13 eligibility rule [source: whatsapp-pma1].
• whatsapp-pma3 — WhatsApp Help Center, How to set-up a parent-managed account. Primary source for the device-side setup, the QR-code link, and the 6-digit parent PIN [source: whatsapp-pma3].
• support-xbox-age-en — Xbox Support, Age restrictions for Xbox accounts (EN). Primary source for the age-based content gating on Xbox [source: support-xbox-age-en].
• microsoft-ms-family-safety — Microsoft Support, Managing parental consent. Primary source for the family-group setup [source: microsoft-ms-family-safety].
• microsoft-ms-limits-en — Microsoft Support, Spending limits in Family Safety (EN). Primary source for the spend-approval paths [source: microsoft-ms-limits-en].
• microsoft-ms-time-en — Microsoft Support, Set screen time limits across devices (EN). Primary source for the cross-device screen-time path [source: microsoft-ms-time-en].
• microsoft-ms-age-en — Microsoft Support, Age groups and Microsoft accounts (EN). Primary source for the Microsoft age-based gating [source: microsoft-ms-age-en].
• epic-cabined — Epic Games Help, How do I complete the parental consent process?. Primary source for the 2022-12-07 Cabined Accounts rollout and the verification options [source: epic-cabined].
• epic-pc — Epic Games Safety, Parental Controls. Primary source for the regional variation in verification options [source: epic-pc].
• www-minecraft-official — Minecraft.net, Parental Controls in Minecraft. Primary source for the Minecraft-on-Microsoft-Family-Safety framing [source: www-minecraft-official].
• www-pew-teens-2024 — Pew Research Center, Teens, Social Media and Technology 2024. Primary source for the 73% daily YouTube figure [source: www-pew-teens-2024].
• mpfs-jim2025 — mpfs, JIM-Studie 2025. Primary source for the 96% WhatsApp, 63% Instagram, 56% Snapchat, and 53% TikTok figures for 12- to 19-year-olds in Germany [source: mpfs-jim2025].
• mpfs-kim2024 — mpfs, KIM-Studie 2024. Primary source for the 73% WhatsApp and 42% TikTok figures for 6- to 13-year-olds in Germany [source: mpfs-kim2024].
• wirecutter-parental-controls — Wirecutter / NYT, 2026 parental-controls review. Independent source for the no control once an app is downloaded observation [source: wirecutter-parental-controls].
• consumer-ftc-parental-controls — US FTC, Parental controls. Independent source for the one-layer framing [source: consumer-ftc-parental-controls].
• saferinternet-technischer-kinderschutz — Austrian Safer Internet Centre, technical child-protection guidance. Independent source for the layered-approach framing [source: saferinternet-technischer-kinderschutz].