Glossary

The wiki’s domain terms are defined once here. Every article references the terms it uses from this page.

Each entry follows the same two-sentence pattern: what the term is, and why a parent of a 6- to 16-year-old should care. The target audience is a non-technical parent; the explanations aim for the level of a footnote in a parenting guide, not a textbook.

The internal terms used by the editorial team live in docs/glossary.md. Those are not part of the reader-facing catalogue.

Definition

A glossary is the central reference for domain vocabulary. When an article uses a technical term for the first time, the article itself explains it in one sentence. The glossary collects every such explanation so that the reader has one place to look.

Scope

The reader-facing glossary covers terms a parent is likely to meet in the wiki: encryption, networking, device features, platform mechanisms. Examples: ECH, DoH, DoT, Private Relay, Sideloading, MAC randomisation, MDM, AOSP, Jailbreak, Bootloader. Engineering and editorial-internal terms are deliberately excluded.

ECH

Encrypted Client Hello — a TLS 1.3 extension that encrypts the domain name in the connection setup [source: www-rfc9849-ech]. This matters for parents because when ECH is active, even the network operator can no longer see which site a child’s device is connecting to.

DoH

DNS over HTTPS — the DNS resolver runs over an encrypted HTTPS connection instead of plaintext UDP [source: www-rfc8484-doh]. This matters for parents because plaintext DNS lets anyone on the path between the child’s device and the resolver log every site name the device asks about. DoH shuts that down on the network leg.

DoT

DNS over TLS — the DNS resolver runs over an encrypted TLS connection, usually on port 853 [source: www-rfc9076-dns-privacy]. This matters for parents because DoT achieves the same privacy goal as DoH, with a separate, dedicated port that is easier to block or allow in router firewalls.

Private Relay

Apple’s relay service that hides the IP address of Safari browsers and some iCloud connections from the destination server. This matters for parents because Private Relay changes what an observer on the public internet can learn about a child’s device — the destination sees Apple’s egress, not the child’s IP.

Sideloading

Installing an app on Android or iOS from a source other than the first-party app store. This matters for parents because sideloaded apps bypass the store’s review and are a common delivery mechanism for malware; the platform’s parental-control features also assume apps came from the store.

MAC randomisation

A device’s Wi-Fi and Bluetooth interfaces periodically use random hardware addresses instead of the real MAC, so a passive observer cannot track the device by its hardware fingerprint alone. This matters for parents because MAC-based router rules (block this MAC, allow that one) are unreliable on a device that randomises. You can still block by SSID or by the parent’s account, but not by MAC alone.

MDM

Mobile Device Management — a class of software that lets an organisation (school, employer, family-shared Apple ID) push settings, profiles, and apps to enrolled devices. This matters for parents because MDM is the mechanism behind school-issued iPads and behind Apple Configurator family setups. Knowing the term helps you recognise when a setting is “managed by the school” vs. “set by you at home”.

AOSP

Android Open Source Project — the open-source base of Android, without the Google services layer. This matters for parents because some cheaper or privacy-focused Android devices ship AOSP builds without the Play Store. Parental-control features that assume the Play Store (Family Link, Google Play parental controls) do not apply on AOSP-only devices.

Jailbreak

Removing the software restrictions Apple places on iOS so that apps and settings outside the App Store sandbox become possible. This matters for parents because jailbroken iPhones run code Apple hasn’t reviewed, can install apps that bypass Screen Time, and opt out of the parental-control guarantees Apple ships. A jailbroken device is functionally outside the scope of every article in this wiki.

Bootloader

The lowest-level program on an Android or iOS device that loads the operating system. The bootloader usually verifies that the OS is signed by the manufacturer before booting it. This matters for parents because unlocking the bootloader (common on Android to flash custom ROMs) defeats the platform’s chain of trust and removes the parental-control guarantees the stock OS provides.

Screen Time

Apple’s name for the set of parental-control features on iPhone, iPad, and Mac (usage limits, downtime, content filters, Screen Distance, communication safety). This matters for parents because Screen Time is the mechanism every iOS article in this wiki refers to. The feature name is also a useful umbrella for the controls this device ships with.

Family Link

Google’s name for the set of parental-control features on Android (app installation approval, screen-time limits, content filters, location sharing). This matters for parents because Family Link is the equivalent of Apple’s Screen Time on Android. Every Android article in this wiki refers to it under that name.

DNS

Domain Name System — the lookup service that turns a name like parentalcontrol.wiki into an IP address. This matters for parents because every other parental-control feature (content filters, router rules, time scheduling) usually acts on a DNS query. If DNS is bypassed, those features lose much of their effect.

VPN

Virtual Private Network — an encrypted tunnel between the device and a remote endpoint. This matters for parents because a VPN on a child’s device routes all traffic through the VPN provider’s server. DNS-based parental controls and router rules stop working until the VPN is disabled.

Hotspot

A device that shares its mobile data connection over Wi-Fi or Bluetooth so that another device can get online through it. This matters for parents because a child’s laptop may use the parent’s phone as a hotspot. In that case the router’s parental controls don’t see the laptop at all — the actual network access goes through the mobile network.

IPv6

The newer version of the Internet Protocol that most home routers and mobile networks now also run alongside IPv4. This matters for parents because some parental-control routers only inspect IPv4 traffic and silently let IPv6 through. Half the device’s traffic may be unfiltered.

4C

The classification this wiki uses for online risk to children: Content, Contact, Conduct, Contract, plus a cross-cutting layer for risks that span all four [source: doi-core-4cs]. This matters for parents because the four categories need different answers — a content filter does nothing about contact risk, and neither touches what a child agrees to when they tap “accept”. The four names are the wiki’s own risk axis; see The 4Cs of online risk.

DSGVO

The German name for the EU General Data Protection Regulation (GDPR). Its Article 8 lets each member state set its own digital age of consent between 13 and 16 [source: euconsent-gdpr-art8]. This matters for parents because the “age 13” that app stores show is not one rule: Germany sits at 16, Austria at 14, the UK at 13. See Age limits are not protection.

JMStV

Jugendmedienschutz-Staatsvertrag — the treaty between the German federal states that governs youth protection in media. Its §11 recognises filtering software as a Jugendschutzprogramm [source: www-jusprog-hintergrund]. This matters for parents because state recognition says a product met a documented procedure; it does not say the product blocks what your child actually reaches.

APK

The file format an Android app is packaged in. An APK can be installed from outside Google Play — from a website, an email, or another store — once the phone allows “Install unknown apps” for that source [source: google-android-alternative-distribution]. This matters for parents because Family Link’s Play Store rules do not reach an app that arrives as an APK file; see Android app install paths.

Bluetooth

A short-range wireless link between devices close to each other — headphones, watches, speakers, game controllers [source: source-android-bluetooth]. This matters for parents because it is a separate radio from Wi-Fi: rules set on the home router do not see what travels over it, and it uses its own device address.

COPPA

The US Children’s Online Privacy Protection Rule. It covers children under 13 and requires a service to get verifiable parental consent before it collects their personal information [source: ftc-coppa-rule]. This matters for parents because it is the reason many apps set their minimum age at 13. That is a legal line about data collection, not a judgement that the app is safe from 13 on. See Age limits are not protection.