Why this matters:How to recognise this workaround on your side, and what closes it on your side — without telling you how to do the workaround.
How common it is: Per-app VPN configurations are documented device features. Specific use as a parental-control circumvention technique among minors is not established.
Detection
A VPN is active on the device but a specific browser or app reaches the Internet through the carrier’s default path; the per-app VPN profile lists a subset of apps rather than all traffic.
Fix (technical)
Audit the per-app VPN profile to confirm which apps are inside the tunnel. A per-app VPN is an opt-in selection, not a default; anything not listed routes normally. On managed devices, configure the profile to cover every app the household intends to cover.
Fix (relational)
A per-app VPN is a legitimate configuration for privacy, work, and school contexts. Treat it as a configuration to review together rather than as an evasion finding.
Residual risk
Newly installed apps may default to the carrier path. Re-audit the profile after every app install; the configuration does not self-update.
Sources
-
www-rfc7754-filtering
-
saferinternet-technischer-kinderschutz
Why trust this page?
Belief-disclosure in plain language. Everything the page claims is sourced; instructions are tested against the software version stated above; nothing is bought or affiliate-linked.
- Standing of evidence
- Primary (first-hand or regulatory source)
- Last verified
- 2026-08-20
Sources used on this page, in the order they appear:
- No external sources were cited.