How to judge a parental-control app before you pay

A parent searching “best parental control app” lands on a list listicle. The list names a winner. The list has no methodology [source: klicksafe-warentest-summary].

This page is the opposite tool. It is a set of questions to ask before paying, not a ranking. It exists because the published material for parents in this category is structurally broken, and the most useful response is to give parents a way to evaluate the product themselves [source: klicksafe-warentest-summary].

Definition

A judgment framework for parental-control apps is a list of questions a parent can answer from public, dated sources.

Questions come from one of three places:

• independent tests with a published methodology and a date [source: www-avtest-2017-16apps] [source: test-warentest-2020];
• documented vendor disclosures, where the vendor itself describes what the product does and does not do [claim: bark-app-page];
• documented incidents, where a court, a regulator, or a security researcher has published a finding [source: mspy-techcrunch-2024] [source: life360-moneypilot-2026].

A judgment framework is not a ranking. It does not produce a winner. Two products can pass the same questions and still differ in ways that matter to a specific family.

Scope

This page covers the questions to ask of a third-party parental-control app before purchase or subscription.

It does not cover the operating-system tools that ship with iOS or Android. Those have their own setup pages [source: apple-screen-time].

It does not cover routers, DNS filters, or network-layer controls. Those are documented separately.

It does not cover apps aimed at concealing monitoring from the child. The Coalition Against Stalkerware draws the line at covert installation and non-consensual monitoring [source: stopstalkerware-coalition-stalkerware-en].

It does not name a “best” app. The editorial stance of this wiki rules out rankings and purchase recommendations: the marketing behind them is structurally broken [source: klicksafe-warentest-summary].

Why this matters

Two thirds of parents of 6- to 13-year-olds in Germany use no technical parental-control tool at all. The most common reason given is that the available information is unclear, outdated, or visibly purchased [source: klicksafe-warentest-summary].

The same problem affects the English-language market. Review listicles publish “Test Winner” badges without a published methodology, a published scale, or a check date [source: www-familienhandbuch-warentest-summary].

The framework below is what those listicles should have provided.

The seven questions

Each question is followed by what to look for and where to find it. A vendor that makes a claim but cannot show the underlying evidence is not a vendor to trust on that point.

1. Is there a current independent test of this product?

This is the first and most important question. Most products in this category are not independently tested at all.

Across the German and English-language coverage, only two institutions regularly publish comparative tests with a stated methodology and a named scale: Stiftung Warentest in Germany and AV-TEST, a technical lab also based in Germany [source: test-warentest-2020] [source: www-avtest-2017-16apps].

K-Tipp in Switzerland has tested adjacent hardware — children’s GPS smartwatches — but has not published a comparative test of parental-control apps [source: www-ktipp-tests-overview].

What to look for:

• a test body with a published methodology,
• a test date that is less than 18 months old,
• a scale that is named (school grade, percentage, pass/fail), and
• a list of all products tested, not just the winner.

If no current independent test exists, the practical answer is that the rating you are reading is a vendor rating, not an independent rating.

2. What does the product do on the platform my child uses?

iOS and Android are not equivalent for parental-control apps. Apple restricts background content access. Vendors that advertise real-time monitoring on iOS either work around the limit or quietly drop the feature on iOS [claim: bark-app-page].

In 2019, Apple removed several MDM-based parental-control apps from the App Store, including OurPact, citing the privacy implications of Mobile Device Management profiles. Apple restored the apps later that year, with restrictions [source: ourpact-appleinsider-2019] [source: ourpact-techcrunch-2019].

What to look for:

• a feature list that is separated by platform, not a single list for “Android and iOS”,
• a public statement when features are platform-limited [claim: bark-app-page],
• the absence of a hidden second version of the app.

3. Does the product let a child bypass it on purpose?

A control that fails if the child knows the family password is a control that fails for the children who most need it.

The 2025 Stiftung Warentest / SWR test found that Apple’s built-in Screen Time restrictions can be defeated via the Accessibility “unterstützender Zugriff” mode. The normal-mode time limits worked “recht gut” — fairly well — but the bypass exists [source: www-warentest-ios-bypass-2025].

What to look for:

• an independent test that includes motivated-child scenarios, not only default-install scenarios,
• a documented parent-side alert when the child signs out of the parental app or the OS family group,
• a clear statement of which setting is the last line of defense (the OS family configuration, the app’s local profile, the child account).

4. What data does the product collect, and where is it stored?

This is the question parents ask least and should ask first.

A monitoring app that ends up in a data breach is a new exposure, not a mitigated one. mSpy, a stalkerware-class product, has been breached three times — 2015, 2018, and 2024. The 2024 breach exposed millions of customer support emails and ticket contents, including data from monitored minors [source: mspy-techcrunch-2024] [source: mspy-theregister-2024].

A location-first product can carry the same risk. Life360, a family-location app, was the subject of a 2023 class action over selling precise location data to data brokers, and a January 2025 FTC order to halt the sale of sensitive precise location data [source: life360-moneypilot-2026] [source: life360-markup-2023].

What to look for:

• a privacy policy that lists the data categories collected,
• a named retention period for each category,
• a named data controller and a named jurisdiction [source: apple-screen-time],
• the publication history of breaches, CVEs, or class actions against the product or its parent company.

5. Has the product been the subject of a published security finding?

A documented CVE is a fact. A vendor’s “no known vulnerabilities” banner is a claim.

Wondershare FamiSafe 1.0 for Windows has a CVE-2022-50902 privilege-escalation vulnerability, assigned CVSS 8.4 (“High”) and published to the NVD in January 2026 [source: famisafe-cve-sentinelone] [source: famisafe-cve-deepaegis].

The vendor’s marketing positions the product as an AI-monitoring solution. A privilege-escalation in the client is a data-exfiltration risk on the parent’s side, not just the child’s.

What to look for:

• a search of the public CVE databases for the product and its parent company,
• a search of the relevant data-protection regulator’s enforcement feed,
• the date of the last published security finding — none yet recorded is not the same as none found.

6. Is the product still being maintained?

A parental control that stops receiving updates is not a parental control. It is a feature set on a device the parent has stopped configuring.

ESET Parental Control for Android reached End-of-Sale on 30 June 2025 and is scheduled for End-of-Life on 30 June 2026 [source: supporteol-eset-eol-policy] [source: www-eset-eol-de].

What to look for:

• a public release-notes feed,
• a public end-of-life policy with a date,
• an active customer support channel that answers in days, not weeks.

7. Is the price clear, and is the renewal clear?

A surprising share of products in this category carries a subscription that auto-renews at a higher tier, or a device-based price that resets when the child gets a new phone [claim: bark-app-page] [claim: bark-pricing-support].

What to look for:

• a published price, with a date, on a page the vendor owns,
• an explicit statement of auto-renewal terms,
• a clear answer to “what happens when the subscription ends” — most parental controls stop filtering on the same day the subscription ends. Built-in operating-system tools do not.

A reading rule for the answers

A “yes” to each question is a starting condition, not a guarantee. A “no” to question 1 (no current independent test) is the more common answer, and it is not disqualifying in itself — it tells the parent to read the rest of the answers more carefully.

A product that fails questions 3, 4, 5, or 6 is a product to walk away from, regardless of what its feature list says.

A product that is loudly marketed and quietly expanding its data collection in the privacy policy is a product to walk away from specifically because of the marketing.

The U.S. Federal Trade Commission recommends treating any single parental-control setting as one layer of protection, not a complete solution [source: consumer-ftc-parental-controls].

That framing is the most defensible one for any product, free or paid, independent-tested or not.

What no single product replaces

A product that scores well on every question is still one option in a layered approach. The non-profit JusProg is a state-recognised Jugendschutzprogramm under German youth-protection law, free and member-funded, and scored “gut” in Stiftung Warentest’s 2020 comparison [source: www-jusprog-hintergrund] [source: www-jusprog-faq].

The Austrian Safer Internet Centre describes four layers where technical child protection can be configured: operating-system tools, ISP or mobile-carrier add-ons, third-party apps, and in-app or browser settings [source: saferinternet-technischer-kinderschutz].

A parent who picks one product and trusts it to do everything else has not picked a product. They have picked a contract.

Sources

This page draws on independent test bodies, regulator publications, security advisories, and the legal literature; vendor statements are kept as [claim] and are not used as evidence.

Independent tests and secondary coverage:

• test-warentest-2020 — Stiftung Warentest, “Kinderschutz-Apps im Test: Nur zwei Apps helfen Eltern gut” (2020-08-24, recapped in 2026; full test paywalled).
• www-familienhandbuch-warentest-summary — Independent secondary summary of the 2020 Stiftung Warentest test, with the “spyware” comparison for FamiSafe.
• klicksafe-warentest-summary — Klicksafe (EU Safer Internet DE) coverage of the 2020 test, with the parental-tool-use statistic and the “Testsieger ohne Methodik” structural critique.
• www-avtest-2017-16apps — AV-TEST, “16 Parental Control Apps for Android & Apple iOS” (2017-08-27), the multi-vendor comparison that established the APPROVED certificate.
• www-avtest-2018-multi — AV-TEST, “Test: Parental Control Apps for Google Android, Apple iOS & Amazon Fire OS” (2018-12-15). Only Kaspersky Safe Kids and Norton Family passed full APPROVED at that time.
• www-avtest-kaspersky-2026-pdf — AV-TEST Parental Test 2026 PDF for Kaspersky Safe Kids, the most recent APPROVED certificate.
• www-ktipp-tests-overview — K-Tipp product-test index, used to confirm that no parental-control app test has been published.
• www-warentest-ios-bypass-2025 — Secondary reporting on the Stiftung Warentest / SWR 2025 bypass test of Apple Screen Time.
• test-de-2025-risks — Stiftung Warentest, “Kinderschutz- Apps: Kinderüberwachung mit Risiken” (2025-04-13), the institutional risk-overview update.
• wirecutter-parental-controls — Wirecutter / NYT 2026 review of iOS parental controls, the source for the Safari-only-web-filter, single-Downtime-schedule, and Communication-Safety findings.
• consumer-ftc-parental-controls — U.S. Federal Trade Commission, parental-controls consumer guidance, the one-layer-of-protection framing.

Vendor and platform disclosures cited as structural evidence for known limitations:

• [source: ourpact-appleinsider-2019] — AppleInsider, “Apple returns parental control app OurPact to App Store” (2019-07-11).
• [source: ourpact-techcrunch-2019] — TechCrunch, confirmation of the structural iOS API limitation behind the 2019 purge and restoration.
• [source: www-jusprog-hintergrund] — JusProg e.V., “Hintergrund”, the §11 JMStV state-recognised status of the non-profit Jugendschutzprogramm.
• [source: www-jusprog-faq] — JusProg e.V., FAQ, confirming the free / member-funded model.
• [source: apple-screen-time] — Apple Support, “Use Screen Time to manage your child’s iPhone or iPad”, the primary source for Apple OS-level controls.

Security and regulatory incidents:

• [source: stopstalkerware-coalition-stalkerware-en] — Coalition Against Stalkerware, the definitional boundary between parental-control software and stalkerware.
• [source: mspy-techcrunch-2024] — TechCrunch, “Data breach exposes millions of mSpy spyware customers” (2024-07-10).
• [source: mspy-theregister-2024] — The Register, “Stalkerware vendor mSpy breached for a third time” (2024-07-14), with the breach history.
• [source: life360-moneypilot-2026] — Moneypilot legal-news coverage of the current status of the Life360 FTC order and the 2024 breach (2026-04-06).
• [source: life360-markup-2023] — The Markup investigative reporting (2023-05-31) on the Life360 location-data sales.
• [source: famisafe-cve-sentinelone] — SentinelOne vulnerability database entry for CVE-2022-50902.
• [source: famisafe-cve-deepaegis] — DeepAegis advisory for the same CVE.

End-of-life and policy:

• [source: supporteol-eset-eol-policy] — ESET End-of-Life policy page, with the 30 June 2026 date for Parental Control for Android.
• [source: www-eset-eol-de] — ESET DE-language announcement of the discontinuation.

Layered defence framing:

• [source: saferinternet-technischer-kinderschutz] — Austrian Safer Internet Centre, the layered-defence guidance for technical Kinderschutz.

Vendor claims used only for vendor description, not as evidence:

• [claim: bark-app-page] — Bark product page describing the iOS “Bark Sync” charger-based scan.
• [claim: bark-pricing-support] — Bark pricing/support page describing subscription tiers.

The following sources were reviewed during the research and are deliberately not cited on this page, because they publish star ratings or “best of” rankings without a published methodology: review listicles on Safewise, TechRadar, PCMag, Airdroid, SafetyMode, TechSafeForKids, HyperJar, Kidgy-forum, Phone-Safety. They are documented in the underlying research note RAW/research/f-third-party-tests.md and excluded here by editorial policy.

[source: test-warentest-2020] [source: www-familienhandbuch-warentest-summary] [source: klicksafe-warentest-summary] [source: www-avtest-2017-16apps] [source: www-avtest-2018-multi] [source: www-avtest-kaspersky-2026-pdf] [source: test-de-2025-risks] [source: www-warentest-ios-bypass-2025] [source: wirecutter-parental-controls] [source: consumer-ftc-parental-controls] [source: ourpact-appleinsider-2019] [source: ourpact-techcrunch-2019] [source: www-jusprog-hintergrund] [source: www-jusprog-faq] [source: apple-screen-time] [source: stopstalkerware-coalition-stalkerware-en] [source: mspy-techcrunch-2024] [source: mspy-theregister-2024] [source: life360-moneypilot-2026] [source: life360-markup-2023] [source: famisafe-cve-sentinelone] [source: famisafe-cve-deepaegis] [source: supporteol-eset-eol-policy] [source: www-eset-eol-de] [source: saferinternet-technischer-kinderschutz]