Parental Controls for Mac in 2026 - Setup Guide and What Apple Won't Fix
If your kid uses a Mac for school, you've probably spent some time poking around System Settings trying to figure out what Screen Time actually does. The good news is that Apple has built a surprisingly deep set of controls into macOS. The bad news is that a well-known bypass has been floating around since at least 2021 and Apple still hasn't fully closed it.
This guide covers the full Screen Time setup for macOS Sonoma and Sequoia, the specific bypass methods kids are using, and how to layer additional tools on top so the gaps don't matter as much.
Setting Up Apple Screen Time on Mac
Open System Settings (the gear icon in your Dock or Apple menu) and click Screen Time in the left sidebar. If you manage your child's device through Family Sharing, you'll see a dropdown at the top of the Screen Time panel -- select your child's name before changing anything, otherwise you'll be editing your own limits.
Downtime
Downtime blocks most apps and websites during a scheduled window -- typically overnight or during school hours. To set it up:
- Click Downtime in the Screen Time sidebar.
- Toggle it on, then choose Every Day or Customize Days depending on whether your schedule varies.
- Set the start and end times. A common setup: 9 PM to 7 AM on school nights, with a different window on weekends.
Apps listed under Always Allowed will still work during Downtime -- more on that in a moment.
One thing parents miss: Downtime has a "one more minute" prompt. By default, macOS shows a notification that lets the child tap to get 60 extra seconds. If your child is old enough to know this exists, they will use it. There's no way to disable this prompt entirely from the Screen Time UI, which is a frustration Apple hasn't addressed.
App Limits
App Limits lets you set daily time caps per app or category. Click App Limits, then the + button to add a limit. You can target:
- A specific app (select it from the list)
- A whole category like Social or Games
- All Apps & Categories at once
Set the daily time allowance and toggle Block at End of Limit on. Without that toggle, the limit is just a gentle nudge.
Like Downtime, App Limits has a "15 more minutes" ignore option. You can require a Screen Time passcode to override it -- make sure the passcode is set under Screen Time > Use Screen Time Passcode and that your child does not know it.
Communication Limits
Under Communication Limits, you can control who your child can call, FaceTime, or message -- both during allowed hours and during Downtime. The options are:
- Everyone (no restriction)
- Contacts Only
- Specific Contacts
For younger kids, Specific Contacts is the safest choice. During Downtime, you can allow contact with specific people (like parents) while blocking everyone else. This setting also applies to FaceTime on Mac.
Always Allowed
This is the exceptions list -- apps here work even during Downtime and despite App Limits. By default, Phone, Messages, and FaceTime are always allowed. On Mac, you might also want to add a specific homework app or tool.
Be careful here. If you add a browser like Safari to Always Allowed because your child needs it for school during Downtime, that browser becomes a potential unrestricted access point.
Content and Privacy Restrictions
This is the most powerful section and the one most parents underuse. In the Screen Time sidebar, click Content & Privacy.
Web Content offers three options:
- Unrestricted Access
- Limit Adult Websites (uses Apple's blocklist plus sites you add manually)
- Allowed Websites Only (allowlist -- only sites you explicitly approve are accessible)
For younger children, Allowed Websites Only is the right choice. You add specific domains like khanacademy.org or codecademy.com and everything else is blocked. For teens who need broader access, Limit Adult Websites plus a manual blocklist is more practical, though less reliable.
Store restrictions let you:
- Require password for free downloads (useful even for free apps)
- Disable in-app purchases
- Block explicit content in music, podcasts, and news
- Set a content age rating for movies and TV shows
- Restrict apps by age rating (4+, 9+, 12+, 17+)
Siri restrictions let you disable explicit language and web search results through Siri.
Game Center lets you restrict multiplayer games, adding friends, and screen recording -- relevant if your child plays games that have social features built in.
Under Other, there are system-level restrictions most parents never find:
- Allow changes to Passcode -- turn this OFF so your child can't change the device password
- Allow changes to Account -- turn OFF to prevent signing out of your Apple ID
- Allow changes to Cellular Data -- not relevant on Mac, but worth knowing on iPhone
- Allow Screen Recording -- consider turning OFF
The Bypass Problem Apple Won't Fix
In October 2021, the Wall Street Journal published a report titled "Apple's Screen Time Has a Glitch That Keeps Resetting Parental Controls." The piece described how Screen Time settings would silently reset -- time limits would disappear, restrictions would vanish -- with no explanation. Apple said they were looking into it. Years later, parents are still reporting the same thing.
But the reset bug is only one layer of the problem. Kids discovered several bypass methods that work independently of any software bug:
The date change bypass. A child opens System Settings, navigates to General > Date and Time, turns off "Set automatically," and manually sets the clock forward past the Downtime end time or backward to reset the day's App Limit timer. Screen Time's limits are time-based, so manipulating the clock directly undermines them. On Apple Support Communities, a parent posted in 2023: "My 12-year-old figured out that if he sets the date to tomorrow, his app limits reset. He can do this in about 30 seconds." The thread has hundreds of me-too replies.
The app deletion and reinstall bypass. App Limits track app usage by bundle ID. If a child deletes an app and reinstalls it from the App Store, some versions of macOS have treated the fresh install as a new app with a fresh daily timer. This depends on the macOS version, but it has been reported consistently enough that it's worth knowing about.
The iCloud backup restore bypass. If Screen Time settings are stored locally rather than synced through iCloud, restoring from an iCloud backup on a new device or after an erase can strip the Screen Time configuration. Parents who thought their settings were locked in have found them gone after a restore.
The guest account workaround. If a Mac has Guest User enabled (System Settings > Users and Groups), a child can log in as Guest and use Safari and other apps without any Screen Time restrictions applied. Guest accounts are not covered by Screen Time at all. This is straightforward to fix -- disable Guest User -- but many parents don't know it exists.
The VPN bypass. Screen Time's web filtering works through Apple's content filtering framework, which operates at the app level on Safari and Screen Time-aware browsers. A child who installs a VPN app (if they have App Store access) can route traffic around the DNS-level filtering that Screen Time uses. This is less of an issue if App Store access is restricted, but it's worth knowing.
The common thread in all these bypasses is that Screen Time is a software layer running on hardware that the child has physical access to. Any bypass that gets below the software layer -- changing system time, switching accounts, restoring a different configuration -- can sidestep it.
Layering Additional Controls
Because Screen Time alone has gaps, the practical approach is to layer controls so that bypassing one layer doesn't mean bypassing everything.
Use a Standard (Non-Admin) Account
This is the single most effective thing you can do that most parents skip. If your child's user account has admin privileges, they can change the system date, install VPNs, disable software, and generally work around anything Screen Time puts in place.
Go to System Settings > Users and Groups. Click your child's account. Make sure the Allow this user to administer this computer checkbox is unchecked. If they currently have admin access, you'll need your own admin password to change this.
With a standard account, the date-change bypass requires an admin password. The VPN installation bypass requires an admin password. Most of the methods that kids use to circumvent Screen Time become much harder.
DNS Filtering at the Router
DNS-level filtering works at the network layer, below any app or browser. Services like CleanBrowsing, NextDNS, or OpenDNS allow you to set filtering policies that apply to every device on your home network. To set this up, log into your router's admin panel and change the DNS server addresses to the ones your filtering service provides.
This catches traffic that Screen Time misses -- browsers that aren't Screen Time-aware, apps that use in-app browsers, and anything that runs over the network in the background.
The limitation is that it only applies when the child is on your home network. On a school network or cellular hotspot, router-level DNS filtering does nothing.
Application-Layer Allowlisting with 3Eyes
DNS filtering handles the network layer, but it doesn't give you fine-grained control over which specific websites are reachable, and it doesn't provide per-app control. 3Eyes works at the application layer -- it intercepts traffic from the Mac regardless of which browser or app is making the request, and compares the destination against an allowlist you define.
The key difference from Screen Time's web filtering is that it operates at the system level rather than inside Safari. A child who opens Chrome, Firefox, or an in-app browser still goes through the 3Eyes allowlist. This closes the "just use a different browser" workaround that Screen Time's Safari-focused filtering leaves open.
Disable Terminal and Script Execution
A child with some technical curiosity and a Google search can find Terminal-based methods to work around controls. To reduce this risk:
Go to System Settings > Screen Time > Content and Privacy > Other and disable Allow Changes for anything listed there. Additionally, in App Limits, you can add Terminal (found under Utilities in the app list) and set a zero-minute limit or block it entirely.
If your child needs programming tools for school, use App Limits to allow specific IDEs while blocking Terminal access.
Enable FileVault
FileVault is disk encryption, which isn't directly a parental control -- but it prevents a child from booting from an external drive (a method sometimes used to access the filesystem outside of the normal macOS environment). Enable it under System Settings > Privacy and Security > FileVault.
Mac Parental Control Features Most Parents Miss
Managed Apple IDs and Family Sharing
If your child is under 13, their Apple ID must be a Managed Apple ID created through Family Sharing. Go to System Settings > [Your Name] > Family Sharing and add a child account. Apple will walk you through creating a child Apple ID with parental approval baked in.
Children under 13 in a Family Sharing group automatically have Ask to Buy enabled -- they can't purchase or download anything from the App Store, including free apps, without your approval. You'll get a notification on your device and can approve or decline from there.
Restricting System Preferences Access
Even on a standard account, a child can open System Settings and see most of the configuration options. To lock down specific panes, you'd typically handle this through an MDM (Mobile Device Management) profile if you're managing a fleet of devices, but for a home setup the most practical approach is to use the Screen Time > Content and Privacy > Other settings to prevent changes to key areas.
Specifically, disable Allow changes to Passcode, Allow changes to Account, and Allow Screen Recording.
App-Level Firewall Controls
macOS has a built-in application firewall under System Settings > Network > Firewall. Turning on the firewall lets you block incoming connections per application. This is more relevant for network security than for parental controls, but it can prevent certain apps from making network connections entirely -- useful if you want to allow an app to run locally but not connect to the internet.
Content Restrictions in App Store Apps
Many education apps and games have their own built-in parental controls separate from Screen Time. Safari has its own content filters. Google Chrome can be managed through a Google Family Link account linked to your child's Google account. If your child uses Chrome for schoolwork, setting up Family Link on Chrome gives you URL-level blocking within Chrome that doesn't rely on Screen Time at all.
Setup Guide for Homeschool Families Using Mac
Homeschool families often have the opposite problem from typical school setups -- the Mac needs to be both a learning tool and a restricted device, sometimes simultaneously. Here's a setup that works well:
Create a Dedicated Education Account
Rather than trying to manage Screen Time on your child's primary account, create a separate Standard user account specifically for school hours. Name it something clear like "School - [Child's Name]."
On this account:
- Pre-install the apps your curriculum requires (Khan Academy, Google Classroom, specific subject software)
- Set up Screen Time with Allowed Websites Only and add only the domains your curriculum actually uses
- Disable the App Store (under Content and Privacy > Store, turn off App Store access entirely)
Your child switches to this account during school hours and uses their regular account (with its own, more relaxed limits) for free time. The school account stays clean.
Lock Down Safari and Chrome
In the education account, go to Screen Time > Content and Privacy > Web Content and select Allowed Websites Only. Build out a whitelist of the specific sites your curriculum requires. Common additions:
- khanacademy.org
- docs.google.com
- classroomq.com
- Your specific curriculum provider's domain
For Chrome, sign into the education account with a managed Google account (set up via Google Family Link or Google Workspace for Education) and apply Chrome's built-in supervised user settings to mirror the allowlist.
Control App Installation
On the education account, disable App Store access. Any new apps that need to be installed should require you to log in with your admin account and install them yourself. This prevents curriculum drift (the gradual accumulation of games and entertainment apps that find their way onto a school device).
Schedule Downtime Around the School Day
Set Downtime to cover the evening and early morning, and use App Limits to restrict non-educational apps during school hours. If your school day is 9 AM to 3 PM, set App Limits on Social, Entertainment, and Games categories to zero minutes from 8:30 AM to 3:30 PM.
Closing the Gaps with 3Eyes
The honest summary of Apple Screen Time in 2026 is that it's a useful foundation with real weaknesses. It works well when your child isn't trying to get around it. Once they start looking for workarounds -- and the internet will teach them how -- Screen Time alone stops being reliable.
The layered approach described above isn't about distrust. It's about making the controls resilient enough that your child's browsing environment stays predictable without turning into an arms race. DNS filtering handles the network, Screen Time handles the app tier, and a tool like 3Eyes handles the application-layer filtering that covers what Screen Time's Safari-centric approach misses.
3Eyes works as an allowlist at the system level -- you define which websites are accessible, and that list applies regardless of which browser or in-app browser your child uses. It doesn't rely on Screen Time's passcode or Apple's time-based logic, so it doesn't have the same bypass surface. If you're already running Screen Time and want to close the browser-based gap, the 3Eyes setup takes about five minutes.
The goal isn't perfect lockdown -- it's enough stability that you can let your child use the Mac for school without checking in every hour to see what they've gotten into. For most families, the combination of a standard account, Screen Time content restrictions, and an application-layer allowlist is enough to get there.