Short answer: parental controls can sit in three places. Controls built into the child’s device, such as Apple’s Family Sharing controls or Google’s Family Link, are documented for their own platforms. Router controls, in ASUS’s documented example, apply to the devices on the network they’re set for. A family DNS filter blocks categories of websites for devices that use it. Each has gaps; our view on combining them is at the end.
The three layers
Device controls: Apple and Google
Apple. Apple’s parental controls for iPhone and iPad are set up through Family Sharing, using content and privacy restrictions that include website filtering. Apple says Ask to Buy and Ask to Browse are on by default for children under 13, and Limit Adult Websites for children under 18. Apple’s current guide is written for iOS and iPadOS 27, so menus may differ on older versions.
Google. Family Link supervises Android devices, Chromebooks and compatible Fitbit devices. Google is explicit about the limit: iPhones, iPads and computers other than Chromebooks can’t be supervised with Family Link.
Controls for Windows PCs and games consoles aren’t covered in this guide; check their makers’ own help.
Router controls
Router makers implement controls differently, and this guide uses ASUS as a documented example; check your own router’s documentation for what it offers.
ASUS’s Kid’s Network is a separate Wi-Fi network for children’s devices. ASUS says it applies schedules and website rules consistently to the devices connected to it, with content filtering done through DNS. ASUS gives its reason for using a separate network: traditional per-device controls are complicated by modern privacy modes that change devices’ MAC addresses. ASUS lists it for Wi-Fi 7 ZenWiFi and select other Wi-Fi 7 models, on firmware 3.0.0.6.102_34946 or later.
If you’re choosing a router with controls in mind, our list of routers for parental controls compares the options.
DNS filtering
A family DNS service blocks categories of websites when they’re looked up. Cloudflare says that when a domain is blocked, its service returns the address 0.0.0.0 instead of the real one. Its 1.1.1.1 for Families blocks malware at 1.1.1.2 and 1.0.0.2, and malware plus adult content at 1.1.1.3 and 1.0.0.3, with matching IPv6 addresses for networks that use IPv6. Where to change your DNS settings is covered in how to change your DNS server.