Why Roblox, Discord and YouTube are hard to block

A parent blocks the Roblox app icon. The child still plays Roblox, in a browser tab. A parent blocks YouTube. The child still watches YouTube, inside a game.

The conclusion the parent draws is the setting is broken. Or worse, the child is hiding things.

Both conclusions are usually wrong.

The problem is rarely the child. The problem is rarely the setting, either. The problem is the way these services are built.

Roblox is a platform and a browser at the same time. Discord runs on the web as easily as it runs as an app. YouTube is embedded in dozens of apps that do not look like video apps at all.

A block on an app icon targets one symbol on one home screen. It does not target the service that symbol stands for.

This page explains why that is so, in three services. It also explains what the difference between blocking an app and blocking a service means for the rest of the wiki.

It also says where no technical measure holds. Saying that honestly is more useful than recommending a setting that will not survive a Tuesday.

The article is verified against help pages retrieved on 2026-08-16 [source: roblox-pc] [source: discord-fc1] [source: google-yt-supervised].

Definition

A service is a product that lives on the company’s servers and that the child reaches through an account, not just through an app icon.

A block on the app is a setting that prevents the named application from running on the device.

A block on the service is a setting that prevents the account, the content, or the spending from working.

It works regardless of which app the child uses to reach it.

The rest of this article is about the gap between the two.

The gap exists in three shapes. One for each of the services named in the title.

Scope

This article covers three service types. It covers the way each of them defeats an app-level block.

It covers the documented in-app controls on each of those services. It also covers what those controls reach and do not reach.

It does not cover the per-service setup. For setup, see Settings inside the apps. That is the step-by-step companion to this page.

It does not cover the iOS or Android device layer. For that, see Reading your child’s Screen Time report and The network layer: router, DNS and their limits.

It is not a circumvention guide. The wiki’s trick database documents the specific shapes of bypass, separately, in a way that does not instruct.

Why this matters

The most common reason parents search for help on this topic is that a block did not hold.

The settings-inside-the-apps article is built around the assumption that the in-app setting is configured. This article explains why that configuration is sometimes not enough, and what to expect from it.

Three facts set the scene.

The first is that the children use these services at scale.

In Germany, 73% of 6- to 13-year-olds use WhatsApp weekly. 42% of the same age group use TikTok regularly. This is despite TikTok’s 13+ terms of service [source: mpfs-kim2024].

Among 12- to 19-year-olds in Germany, WhatsApp is regular use for 96%. Instagram for 63%. Snapchat for 56%. TikTok for 53% [source: mpfs-jim2025].

In the US, 73% of 13- to 17-year-olds report daily YouTube use [source: www-pew-teens-2024].

The volume makes the in-block question matter.

The second is that the shape of the service changes what a block can reach.

The third is that the in-app control is a metadata surface in most cases. It shows who, when, and how long. Not what the child said or played.

Independent testing observes that once a child has downloaded an app, the parent has “no control, insight, or management of what your child sees or experiences” inside it [source: wirecutter-parental-controls].

The Safer Internet Centre in Austria treats in-app controls as one layer, not the answer [source: saferinternet-technischer-kinderschutz].

The rest of this page names where each block stops, by service.

Roblox is a platform and a browser at the same time

Roblox is best thought of as two things stacked: a game launcher and a browser that happens to render as 3D worlds.

A parent who blocks the Roblox app has blocked the launcher. The browser, and the account, are still open.

Three documented shapes make this concrete.

The first is that Roblox can be reached in a browser at roblox.com, without the app installed [source: roblox-pc].

The official help page describes the parental controls as configuring the account, not the launcher [source: roblox-pc].

The same controls apply whether the child uses the app, the web, or a console version of the launcher.

The second is that content maturity is set on the account, not on the device.

Roblox documents the maturity level as a setting on the parent-privilege account. It has sub-panels for individual controls [source: roblox-pc]

[source: roblox-parental-controls-overview].

A device-level block on the app does not change the maturity level on the account the child signs into elsewhere.

The third is that spending happens inside the account and travels with it.

Roblox explicitly states that monthly spending limits do not cover gift-card redemptions. It also states that limits on the platform do not cover spending through a connected console store [source: roblox-monthly-spending]

[source: roblox-parental-controls-overview].

The trick database documents both shapes as separate entries.

The wiki’s settings-inside-the-apps page walks through the parent-privilege setup in detail.

The summary here: an app block on the Roblox icon does not cover a Roblox account.

Discord runs on the web as easily as it runs as an app

Discord is a chat service. The Discord desktop app, the mobile app, and the web client at discord.com are three front ends to the same account.

The company’s family surface, Family Center, attaches to the account, not to any one of the three front ends [source: discord-fc1] [source: discord-fc2].

Three documented shapes make this concrete.

The first is that the link must be initiated from the Discord mobile app, on the teen’s device, via a QR-code scan [source: discord-fc-eng].

A block on the desktop app, or on the web front end, does not prevent the link from being made on the mobile app.

The second is that the activity feed Discord shares with the parent is metadata. It includes servers joined, new friends, time spent.

Discord states explicitly that the surface is designed to keep parents informed “while still respecting their teen’s privacy” [source: discord-fc1].

Message content, voice channel audio, and direct-message text are not part of the feed.

The third is that the link is opt-in on the teen’s side.

A teen can decline the invite.

A teen who has already linked can unlink later [source: discord-fc-teen].

When the link is unlinked, the parent is notified.

The parent cannot re-lock the link from their side.

A block on the Discord app icon does not block the Discord account, and does not reach the places Discord’s family surface reaches either.

YouTube is embedded in dozens of apps that do not look like video apps

YouTube is the most embedded video service in the consumer internet.

A parent who blocks the YouTube app has blocked one front end to a service that is reachable in many other shapes.

The YouTube help page describes the supervised-account model in detail. It is explicit that the content setting applies in the YouTube app and on the YouTube website when the supervised account is signed in [source: google-yt-supervised].

Two documented shapes make the embedding concrete.

The first is that YouTube is reachable in any browser, signed in or signed out.

The trick database records the signed-out or public web view as a documented shape of access.

A YouTube web view can carry watch time that does not appear in the supervised account’s own activity. This is because no account is involved [source: google-yt-supervised].

The second is that the YouTube player is embedded in many apps that do not look like video apps.

A game that has a Watch button, a learning app that has a How to clip, a fitness app that has a tutorial section, and a chat app that links to a video all open the YouTube player without opening the YouTube app.

The settings-inside-the-apps article names the YouTube Kids content-level settings, the supervised-account content level, and the Restricted Mode toggle as the three documented surfaces for YouTube [source: google-youtubekids]

[source: google-yt-supervised] [source: google-youtube-options].

None of those three surfaces covers an embedded player in a third-party app.

A block on the YouTube app icon does not block the YouTube service on the open web. It does not reach the embedded player at all.

Why the same gap shows up in every service

The three examples above look like three separate problems. They are not.

The same pattern appears across the rest of the services the wiki covers, for the same reason: the service lives on a server, the app is a front end, and the parental control is built on the account.

TikTok’s family surface, Family Pairing, attaches to the account, with rules on screen time, restricted mode, and direct messages [source: tiktok-family-pairing].

A block on the TikTok app icon does not block the TikTok account on the web.

Snapchat’s family surface attaches to the account. It shows who the teen talked to, not what they said [source: snapchat-snap-fc1].

A block on the Snapchat app icon does not block the Snapchat account on the web.

WhatsApp’s parent-managed accounts are a property of the account. A 6-digit parent PIN gates the privacy settings [source: whatsapp-pma1].

A block on the WhatsApp app icon does not block the WhatsApp account on the web.

Meta’s family surface for Instagram and Messenger attaches to the account. It shows topic categories of AI interactions, not the prompts or responses [source: meta-ai-insights].

A block on the Instagram or Messenger app icon does not block those accounts on the web.

ChatGPT’s parental controls attach to the account.

OpenAI states explicitly that “parental controls do not let a parent or guardian read or monitor the teen’s conversations” [source: help-chatgpt-faq].

A block on the ChatGPT app icon does not block the ChatGPT account on the web.

Character.AI’s Parental Insights attach to the account, and Character.AI states explicitly that the digest “does not include a user’s chat content” [source: character-charai-pi]. A block on the Character.AI app icon does not block the Character.AI account on the web.

Signal and Telegram have no parental-control surface at all, and no age verification at signup [source: support-signal-gdpr] [source: support-signal-gdpr-de] [source: telegram-wales]. A block on either app icon does not block either account on the web, and the company offers no parental knob to turn.

The pattern is consistent. The article that walks through the per-service setup is Settings inside the apps. The point of this page is the cross-service rule.

What no setting can do

Some situations are not solved by a setting, and saying so honestly is more useful than naming a setting that will not hold.

These cases are documented here because the rest of the wiki describes the cases a setting can reach.

A parental control cannot reach a service the company does not control. Signal and Telegram publish no parent-facing surface of any kind [source: support-signal-gdpr]

[source: telegram-wales].

A parent who relies on a setting to mediate the child’s use of these services is relying on a setting that does not exist.

The remedy is a conversation, a household rule, and a device-level limit on the network or the screen. Not a service-level setting.

A parental control cannot reach an account on a device the parent does not manage.

The in-app controls in this article all attach to the account on the device the child uses.

A friend’s phone, a school iPad that is not in the family group, a console on a different account, and a laptop the parent has not set up are all outside the surface [source: wirecutter-parental-controls].

The remedy is a household conversation about which devices the child is allowed to use, and at what ages.

A parental control cannot reach a service the child has re-signed into under a new account, with a false birthdate.

Roblox’s help pages do not address whether a parent-side view persists if the child creates a second unlinked account [source: roblox-pc].

Character.AI’s under-18 restrictions do not apply to a teen who entered a false birthdate at signup. The company does not publish a false-negative rate for its age-prediction system [source: character-charai-safety]

[source: help-chatgpt-faq].

The remedy is the same conversation as above. It is also a device-level block on creating a new account under a false birthdate, where the operating system offers one.

A parental control cannot replace a conversation.

The Safer Internet Centre in Austria and the US FTC both treat parental controls as one layer.

The conversation is the layer that holds when the technical layer does not [source: saferinternet-technischer-kinderschutz]

[source: consumer-ftc-parental-controls].

The wiki is built on the same rule.

The rest of the wiki walks through what each setting does reach. This section is here so a parent does not leave the wiki with the impression that any of those settings is comprehensive. A glossary of terms used in the wiki is at glossary.

What the rest of the wiki does with this

The settings-inside-the-apps article is the step-by-step companion. It names, for each service, what the in-app control configures, and what it does not configure.

The network-layer article explains why a router or DNS filter, which sits at the network layer, also does not follow the device past the front door [source: wirecutter-parental-controls].

The reading-the-screen-time-report article explains why the time report on the parent device is an estimate.

It also explains what the report leaves out. That includes time on a friend’s phone and time in third-party in-app browsers [source: wirecutter-parental-controls].

The purchases article explains why blocking the in-app purchase does not block a gift card, a console store, or a marketplace outside the App Store / Google Play path.

The companion article to this one, in spirit, is What actually works instead of blocking.

It is the constructive side of the same question. If blocking the app does not block the service, what does.

Sources

• roblox-pc — Roblox Support, Parental Controls FAQ. Primary source for the parent-privilege account and the web reach of the account [source: roblox-pc].
• roblox-monthly-spending — Roblox Support, monthly-spending documentation. Primary source for the gift-card and console-store exclusions [source: roblox-monthly-spending].
• roblox-parental-controls-overview — Roblox Support, parental-controls overview. Primary source for the maturity-level setting and the second-account gap [source: roblox-parental-controls-overview].
• discord-fc1 — Discord, Discord Family Center – Safety. Primary source for the activity-feed scope and the metadata framing [source: discord-fc1].
• discord-fc2 — Discord Support, What is Family Center?. Primary source for the in-app settings path [source: discord-fc2].
• discord-fc-eng — Discord Support, Family Center for Parents and Guardians (EN). Primary source for the QR-code-scan setup requirement [source: discord-fc-eng].
• discord-fc-de — Discord Support, Family Center für Eltern und Erziehungsberechtigte (DE). Native German confirmation of the help article [source: discord-fc-de].
• tiktok-family-pairing — TikTok Support, Family Pairing. Primary source for the two-sided setup and the account-level scope [source: tiktok-family-pairing].
• google-yt-supervised — Google Support, Parental controls & settings for supervised kid accounts on YouTube. Primary source for the supervised-account content setting and its app-and-web scope [source: google-yt-supervised].
• google-youtube-options — Google Support, YouTube options. Primary source for the Restricted Mode toggle and the supervised-account graduation rules [source: google-youtube-options].
• google-youtubekids — Google Support, Parental controls for YouTube Kids profiles. Primary source for the YouTube Kids content levels and the standalone-client framing [source: google-youtubekids].
• meta-ai-insights — Meta Help, Parents and guardians can see insights about what their teens ask AI. Primary source for the topic-categories framing of Meta AI interactions [source: meta-ai-insights].
• snapchat-snap-fc1 — Snapchat Support, What is Family Center?. Primary source for the who not what framing and the explicit no-message-content statement [source: snapchat-snap-fc1].
• whatsapp-pma1 — WhatsApp Help Center, Parent-Managed Accounts. Primary source for the account-level scope and the under-13 eligibility rule [source: whatsapp-pma1].
• help-chatgpt-faq — OpenAI Help, Parental controls in ChatGPT FAQ. Primary source for the explicit no-conversation-content statement [source: help-chatgpt-faq].
• character-charai-pi — Character.AI, Parental Insights. Primary source for the explicit no-chat-content statement and the account-level scope [source: character-charai-pi].
• support-signal-gdpr — Signal Support, Signal and the General Data Protection Regulation (GDPR) (EN). Primary source for the documented absence of parental controls [source: support-signal-gdpr].
• support-signal-gdpr-de — Signal Support, Signal und die Datenschutz-Grundverordnung (DSGVO) (DE). Native German confirmation [source: support-signal-gdpr-de].
• telegram-wales — Hwb (Welsh Government), Telegram. Institutional source for Telegram’s age policy and the absence of parental controls [source: telegram-wales].
• wirecutter-parental-controls — Wirecutter / NYT, 2026 parental-controls review. Independent source for the in-app blind-spot and the no control once an app is downloaded observation [source: wirecutter-parental-controls].
• saferinternet-technischer-kinderschutz — Austrian Safer Internet Centre, technical child-protection guidance. Independent source for the layered-approach framing [source: saferinternet-technischer-kinderschutz].
• consumer-ftc-parental-controls — US FTC, Parental controls. Independent source for the one-layer framing [source: consumer-ftc-parental-controls].
• mpfs-kim2024 — mpfs, KIM-Studie 2024. Primary source for the 73% WhatsApp and 42% TikTok figures for 6- to 13-year-olds in Germany [source: mpfs-kim2024].
• mpfs-jim2025 — mpfs, JIM-Studie 2025. Primary source for the 96% WhatsApp, 63% Instagram, 56% Snapchat, and 53% TikTok figures for 12- to 19-year-olds in Germany [source: mpfs-jim2025].
• www-pew-teens-2024 — Pew Research Center, Teens, Social Media and Technology 2024. Primary source for the 73% daily YouTube figure for US teens [source: www-pew-teens-2024].

[source: roblox-pc]

[source: roblox-monthly-spending] [source: roblox-parental-controls-overview]

[source: discord-fc1] [source: discord-fc2]

[source: discord-fc-eng] [source: discord-fc-de]

[source: tiktok-family-pairing] [source: google-yt-supervised]

[source: google-youtube-options] [source: google-youtubekids]

[source: meta-ai-insights] [source: snapchat-snap-fc1]

[source: whatsapp-pma1] [source: help-chatgpt-faq]

[source: character-charai-pi] [source: support-signal-gdpr]

[source: support-signal-gdpr-de] [source: telegram-wales]

[source: wirecutter-parental-controls] [source: saferinternet-technischer-kinderschutz]

[source: consumer-ftc-parental-controls] [source: mpfs-kim2024]

[source: mpfs-jim2025] [source: www-pew-teens-2024]