Why this matters:How to recognise this workaround on your side, and what closes it on your side — without telling you how to do the workaround.
How common it is: WebRTC ICE candidate leakage is a documented browser behaviour. Specific use as a parental-control circumvention technique among minors is not established.
Detection
A service that is meant to be inside the VPN tunnel receives traffic from a public IP that does not match the VPN provider’s range; the device’s browser or app shows an active WebRTC connection.
Fix (technical)
Disable WebRTC where the browser exposes the setting and the household can verify it. On managed devices, configure the browser to use the tunnel’s IP only and to reject candidate paths that route outside it. Verify the result with the browser’s WebRTC-leak diagnostic before treating the gap as closed.
Fix (relational)
A child who needs video calling for school or friends is asking for a privacy tool, not a bypass. Address the underlying need before disabling the capability.
Residual risk
Built-in browsers and many third-party browsers do not expose a per-site WebRTC toggle. Disabling WebRTC also disables video calls in some services, which may conflict with a household rule that allows them.
Sources
-
rfc9490-mten
-
www-rfc7754-filtering
Why trust this page?
Belief-disclosure in plain language. Everything the page claims is sourced; instructions are tested against the software version stated above; nothing is bought or affiliate-linked.
- Standing of evidence
- Primary (first-hand or regulatory source)
- Last verified
- 2026-08-20
Sources used on this page, in the order they appear:
- No external sources were cited.