One lock can be picked — three is much harder

Tomek Sidor — a forensic computer scientist, court-appointed expert from Lublin, and president of Instytut Antrotech, who has spent 17 years on cases including digital evidence in CSAM investigations — puts it plainly: treat your child’s phone like a door. One lock can be picked. Three is much harder.

That’s not pessimism. It’s honesty. No single filter blocks everything, every filter can be bypassed, and 12-year-olds already bypass parental controls just by asking politely. But once you stack three layers — a conversation, on-device settings, and a network-level filter — defeating all of them takes deliberate effort, not an accidental tap.

This article is the concrete version: what each layer does, how to turn it on, and how long it takes.

Layer 1: The conversation (5 minutes, free, most important)

Without this layer, the rest doesn’t really work. The reason is practical: a child who understands why a site is unsafe will avoid it themselves — on a friend’s phone, at a sleepover, at school. No filter buys you that.

Three sentences worth saying before you configure anything:

  1. “Today I’m setting up a few restrictions on your phone.” Not in secret. Openly, with your child watching.
  2. “I’m doing this not because I don’t trust you, but because there are things online I don’t want you to see yet.” The reason is protection, not control.
  3. “If anything weird shows up — a pop-up, a stranger in a game, a link from a friend — show me. I won’t shout.” That promise stays in force when the child tests it.

For how to lead that conversation without panic, see the family digital contract.

Layer 2A: iPhone and iPad — Screen Time

It’s built in and free. Apple’s full guide is here. Below is the essential parent path.

The taps (iOS 18+)

Settings → Screen Time → Content & Privacy Restrictions → Content Restrictions → Web Content

You get three options:

OptionWhat it doesFor whom
Unrestricted AccessNo filterAdult accounts
Limit Adult WebsitesApple blocks known 18+ sites; you add anything missed to “Never Allow”Default choice for kids 10+
Allowed Websites OnlyA whitelist — ONLY what you add will openAges 6–9, first phone

A separate PIN — non-negotiable

Set a dedicated Screen Time passcode, different from the phone unlock code. Apple has a separate field for it: Settings → Screen Time → Use Screen Time Passcode. Without this, a child who knows the unlock code disables every limit in one screen.

If you forget the code, Apple has a recovery procedure, but it requires logging into the parent’s Apple ID. Store the code somewhere outside the phone.

What else to switch on while you’re there

  • App Store → Installing Apps: “Don’t Allow” for kids under 10. For older kids: leave on, but require purchase approval (“Ask to Buy” in Family Sharing).
  • App Store → In-app Purchases: “Don’t Allow” regardless of age. In-game microtransactions are a separate financial disaster.
  • Content Ratings → Movies / TV / Apps / Books: Set by age. Apple honors EU PEGI/USK categories.
  • App Limits → Daily limits: A budget like 1h for TikTok / YouTube. A content filter alone is not enough — six hours of “safe” YouTube is not okay either.

Apple Family Sharing — manage from your own phone

The best setup uses Family Sharing from the parent’s account. Setting changes, app-install requests, and weekly reports then land on your phone. Configure at: Settings → [Your Name] → Family Sharing.

Layer 2B: Android — Google Family Link

The Android equivalent is Family Link. Free, works on Android 5.0+, requires a Google account for the child (under 13 — under parental supervision).

What you configure (from the parent app)

  1. App management — approve each Play Store install, block specific installed apps.
  2. Content filters — separately for Play Store (lowest age threshold), Google Chrome (adult-site filter), YouTube (switch to YouTube Kids for under-9s).
  3. Time limits — daily cap, bedtime (phone locks itself), per-app limits.
  4. Location — optional, worth negotiating with your child (relationship > tracking).
  5. Google Search — in the child’s account settings, turn SafeSearch into a hard block, not a suggestion.

Since 2026, Android ships a native Parental Controls section in system Settings — quick access to limits without opening the full app.

Family Link requires the child to sign in with their own Google account. A teenager who creates a second “private” account and signs out of the supervised one walks out of Family Link entirely. So this layer protects the phone, not the account. The second protection has to be a network filter (below).

Layer 3: Network-level filter (DNS) — works on every device

Layers 2A and 2B protect one specific device. A DNS filter protects the whole home network — phone, tablet, laptop, console, smart TV — without installing anything on each device. That’s about 10 minutes on the router.

The simplest family starts:

  • Cloudflare 1.1.1.3 — blocks malware and adult content, anonymous, EU/Swiss/US infrastructure.
  • DNS4EU “Child” — European option, GDPR-friendly, with ad blocking.
  • CleanBrowsing Family — three levels: young children / teens / security only.

Which one and how to configure it on the router — the full comparison of 11 options is in Which DNS for a family? A 2026 deep-dive.

Important: a DNS filter isn’t perfect either. It doesn’t filter content inside apps using a VPN, doesn’t help when the child is on mobile LTE instead of home Wi-Fi, and doesn’t block content behind logins. It’s the third lock, not a silver bullet.

What the fourth layer is — the one you can’t configure in 10 minutes

The three layers above are scaffolding. Temporary. They work while you control the device. Eventually:

  • your child gets a first phone you don’t configure,
  • goes to a sleepover and logs into a friend’s account,
  • turns 14, 15, 17 — and you still want them not to fall for phishing or a deepfake.

The fourth layer lives in your child’s head: recognising manipulation, dark patterns, grooming, AI-generated content. You can’t install that in Settings. But you can teach it while you still have influence — Digital self-defense for kids is a concrete guide.

The most common mistake: one layer instead of three

“We have Family Link, so we’re covered.” Or: “I changed the router DNS, the rest isn’t needed.” Each layer works best alongside the others:

  • Conversation alone = relies on the child’s self-control at the first pop-up.
  • Screen Time / Family Link alone = gone when the child picks up a friend’s phone.
  • DNS alone = doesn’t limit TikTok time and doesn’t filter in-app content.

Together, these three locks block ~90% of accidental exposure to inappropriate content. The rest is the fourth layer, which you build over years.

Start today — 30 minutes

  1. 5 minutes: the conversation with your child about what you’re enabling and why.
  2. 10 minutes: Screen Time (iPhone) or Family Link (Android), with a separate passcode.
  3. 10 minutes: change router DNS to 1.1.1.3 or DNS4EU Child.
  4. 5 minutes: save both codes (Screen Time and router) in a password manager.

Tomorrow everything still works — and your home is three locks safer.

Found this useful? Subscribe to the tatai.pl newsletter. Concrete steps for dads in the age of AI.