What these apps cannot do

Even at the best documented end of the parental-control market, none of the products can do a set of things that parents often expect them to do.

These are not defects to be fixed by the next update. They are properties of the platforms the apps run on, and the platforms have not been changed.

This page is a list of those limits, with the system reason for each.

Definition

An operational limit of a parental-control app is a thing the app cannot do because the operating system, the underlying protocol, or the physical device prevents it.

Operational limits are not the same as product weaknesses. A product weakness is something the vendor could fix. An operational limit is something the vendor cannot fix without a different platform.

The product literature blurs the two. The hesitation to use the word “cannot” is one of the structural reasons the category has the marketing problem it has [source: consumer-ftc-parental-controls].

Scope

This page covers the operational limits that hold across parental-control apps on iOS and Android. It does not cover product-specific gaps or unmaintained features.

It does not cover hardware-level controls (routers, DNS filters, cellular carrier add-ons). Those are documented separately.

It does not cover the operational limits of the operating-system tools themselves. Apple Screen Time and Google Family Link have their own limits, and they are documented on their own pages.

It does not name a “best” app. The operational limits apply to the category, not to a single product.

The limits

1. End-to-end encrypted content

No third-party app can read the content inside Signal, WhatsApp, iMessage, or any messenger that uses on-device encryption [source: saferinternet-technischer-kinderschutz].

The Austrian Safer Internet Centre is explicit on this in its layered-defence guidance: end-to-end encrypted messengers are outside the technical reach of any third-party app [source: saferinternet-technischer-kinderschutz].

A vendor that claims to read WhatsApp messages is either lying or running a man-in-the-middle setup on the device. Neither is a parental-control feature.

2. Cross-OS background surveillance on iOS

Apple restricts background content access. The platform API cannot grant a third-party app the kind of background surveillance that an equivalent Android app can sustain [source: ourpact-appleinsider-2019].

In 2019, Apple removed several MDM-based parental-control apps from the App Store, including OurPact, citing the privacy implications of Mobile Device Management profiles. Apple restored the apps later that year, with restrictions [source: ourpact-appleinsider-2019] [source: ourpact-techcrunch-2019].

Bark openly describes its iOS limitation: on iOS, the product requires a periodic USB-tethered “Bark Sync”, not real-time monitoring, because Apple blocks background content access [claim: bark-app-page].

The pattern is documented per-vendor on each product’s own support page, and is a consequence of the iOS background-access limits that triggered the 2019 Apple App Store MDM purge [source: ourpact-techcrunch-2019].

3. A second device, a friend’s phone, a school laptop, a console

A setting on the child’s phone does not reach any of these [source: consumer-ftc-parental-controls].

The U.S. FTC recommends treating any single setting — including a third-party app — as one layer of protection, not a complete solution [source: consumer-ftc-parental-controls].

A parent who has installed a parental-control app on the child’s phone and considers the problem solved has solved one problem. The friend with an unmonitored phone is a different problem.

4. A cellular connection that the home router does not see

A home router rule does not cover mobile data. A phone on the home Wi-Fi is filtered by the home router. The same phone on cellular is not [source: saferinternet-technischer-kinderschutz].

Some parental-control apps compensate with their own mobile filter. Most configure per-device, not per-network. The configuration is the parent’s responsibility, not the app’s.

5. An alternate browser on iOS

The iOS web filter only covers Safari and apps that use the iOS WebKit surface. Independent 2026 testing found that Chrome, Firefox, and in-app web views are not covered by the Web Content filter on iOS [source: wirecutter-parental-controls].

Apple documents the filter scope as the system WebKit surface. A parent who installs the filter on iOS and assumes the browser is locked may not have locked the browser the child actually uses.

6. A work-around the OS permits

The 2025 Stiftung Warentest / SWR test found that time-limit restrictions in normal mode worked “recht gut” (fairly well), and that the Accessibility “unterstützender Zugriff” mode bypassed several restrictions in ways a child could replicate [source: www-warentest-ios-bypass-2025].

This is a structural Apple platform limit, not a defect in any third-party app. The same OS feature that lets a parent of a child with disabilities set up a one-app mode is the feature that lets another child sign out of the family configuration.

An app cannot put back the OS limit the OS itself offers the child a way around.

7. Single iOS downtime schedule per day

Independent 2026 testing confirmed that Apple’s Screen Time permits only one daily Downtime schedule. There is no separate weekday/weekend configuration [source: wirecutter-parental-controls].

This is an Apple-defined cap. iOS restricts the number of schedules a parent can define. A third-party app cannot add schedules the OS does not allow.

8. Communication Safety parent alerts

Apple’s on-device Communication Safety is built around on-device nudity detection that blurs the image on the child’s screen. Independent 2026 testing confirms that the parent does not receive an alert [source: wirecutter-parental-controls].

This is by design. Communication Safety is not a parent-notification feature. A parent who expects a notification from the feature does not get one.

9. A device that has been turned off

Any product, including Apple’s own Find My, requires the device to be powered on and connected [source: apple-screen-time].

A child who has powered off the device has defeated the location function. The device is then a piece of hardware, not a tracked device.

10. A child who has signed out of the family configuration

A child who has signed out of the parental app, of the OS family group, or of the Apple Account itself — depending on which layer is in play — controls the app from the device side.

The ability to sign out is a feature of the OS, not a bug. It is the same feature that lets a competent adult recover access to their own account.

11. A social-engineering attempt against the parent

A parent who can be persuaded to send a one-time code, to approve an in-app purchase “for school”, or to hand over the family password to a “support” caller, bypasses the technical control entirely. No app prevents this.

The Coalition Against Stalkerware draws the line at covert installation and non-consensual monitoring. The same logic applies to a child who co-opts the parent’s trust to break the control [source: stopstalkerware-coalition-stalkerware-en].

12. A purchase made outside the App Store

On iOS in the EU, Screen Time restrictions on in-app purchases do not apply to purchases made through alternative marketplaces [source: apple-screen-time].

A parent who has tightened the in-app purchase setting has tightened the in-app purchase setting. The alternative marketplace is a different surface.

13. A consistent iOS / Android feature parity

A single feature list on a vendor’s website does not mean the same feature on the same platform. Vendors commonly list a unified feature set for “Android and iOS” while quietly dropping parts of the set on iOS [source: wirecutter-parental-controls].

A parent who has paid for the Android feature set on an iOS device has paid for the Android feature set. The iOS feature set is what the platform permits.

14. A vendor that has been breached

For a product whose value is the data it collects, a breach is not a defect. It is a new exposure.

mSpy, a stalkerware-class product, has been breached three times — 2015, 2018, and 2024. The 2024 breach exposed millions of customer support emails and ticket contents, including data from monitored minors [source: mspy-techcrunch-2024].

A breach at the vendor is outside the parent’s control. The vendor’s security posture is part of the product.

15. A score of “the best”

Independent testing does not produce a single best app. The 2020 Stiftung Warentest comparison found two products with the school-grade “gut” — Salfeld Kindersicherung and JusProg — and one product at the bottom of the test (Wondershare FamiSafe) [source: test-de-ios-detail].

A “Testsieger” badge on a listicle is not a test result. It is a commission decision [source: consumer-ftc-parental-controls].

How the limits shape the purchase decision

The limits apply to a category, not to a product. The category has structural limits that no future update will remove.

A parent who has decided the limit is unacceptable for their family — and the limits are not equally unacceptable for every family — can choose to invest more in the non-technical layer (co-use, conversation, media literacy) instead of the technical one.

A parent who has decided the limit is acceptable for their family — because the alternative is no protection at all — can choose a product with documented evidence on the function they need, knowing what it cannot do.

The honest answer for either choice is the same list of limits. The trade-off is the family’s, not the app’s.

Sources

This page draws on Apple platform documentation, regulator publications, independent test reports, and vendor disclosures about platform limits. Vendor descriptions of their own platform limits are noted as [claim].

Platform documentation:

• [source: apple-screen-time] — Apple Support, “Use Screen Time to manage your child’s iPhone or iPad”, the primary source for Apple OS-level controls and for the alternative-marketplace purchase-scope exception.
• [source: wirecutter-parental-controls] — Wirecutter / NYT 2026 review of iOS parental controls, the source for the Safari-only-web-filter, single-Downtime-schedule, and Communication-Safety-no-parent-alert findings.

Regulators and framework bodies:

• [source: consumer-ftc-parental-controls] — U.S. Federal Trade Commission, parental-controls consumer guidance, the one-layer-of-protection framing.
• [source: saferinternet-technischer-kinderschutz] — Austrian Safer Internet Centre, the layered-defence guidance for technical Kinderschutz.
• [source: stopstalkerware-coalition-stalkerware-en] — Coalition Against Stalkerware.

Independent tests:

• [source: www-warentest-ios-bypass-2025] — Secondary reporting on the Stiftung Warentest / SWR 2025 bypass test of Apple Screen Time.
• [source: test-de-ios-detail] — Stiftung Warentest detail page for Apple iOS in the 2020 comparison.

Structural iOS limits:

• [source: ourpact-appleinsider-2019] — AppleInsider, “Apple returns parental control app OurPact to App Store” (2019-07-11).
• [source: ourpact-techcrunch-2019] — TechCrunch, confirmation of the structural iOS API limitation behind the 2019 purge and restoration.

Vendor disclosures of their own platform limits:

• [claim: bark-app-page] — Bark product page describing the iOS “Bark Sync” charger-based scan.

Security and regulatory incidents:

• [source: mspy-techcrunch-2024] — TechCrunch, “Data breach exposes millions of mSpy spyware customers” (2024-07-10).
• [source: life360-moneypilot-2026] — Moneypilot legal-news coverage of the current status of the Life360 FTC order and the 2024 breach (2026-04-06).

The following sources were reviewed during the research and are deliberately not cited on this page, because they publish star ratings or “best of” rankings without a published methodology: review listicles on Safewise, TechRadar, PCMag, Airdroid, SafetyMode, TechSafeForKids, HyperJar, Kidgy-forum, Phone-Safety. They are documented in the underlying research note RAW/research/f-third-party-tests.md and excluded here by editorial policy.

[source: apple-screen-time] [source: wirecutter-parental-controls] [source: consumer-ftc-parental-controls] [source: saferinternet-technischer-kinderschutz] [source: stopstalkerware-coalition-stalkerware-en] [source: ourpact-appleinsider-2019] [source: ourpact-techcrunch-2019] [source: www-warentest-ios-bypass-2025] [source: test-de-ios-detail] [source: mspy-techcrunch-2024] [source: life360-moneypilot-2026]