3Eyes / Blog
2026-08-16 · Dan Clark

Parental Controls Kids Can't Bypass: What Actually Holds

Ask a room of parents which parental control app they use and you will get five answers. Ask how long it took their child to get around it and you will get a much shorter list of numbers: a week, a weekend, an afternoon. This is the complaint that follows every product in the category, and it is rarely because the vendor built something shoddy. It is because most parental controls are built on a foundation a child can step off.

This guide is about product selection, not damage control. If you want the mechanics of specific bypasses, read how parental controls get bypassed. If it has already happened and you need a plan for tonight, read what to do when your kid bypasses parental controls. What follows is the question those two posts don't answer: which kind of tool is still standing in six months, and what you have to do yourself regardless of which one you buy.

Why parental controls get bypassed structurally, not accidentally

Bypasses cluster around four design decisions, and you can predict a product's failure mode from them before you install it.

Account-level tools are escaped with another account. If the policy is attached to a signed-in profile, signing into a different profile ends the policy. One parent on Microsoft's own support forum reported that their child simply created a new profile in Edge, and none of the Family Safety allow or block rules applied to it.

Browser-specific filtering is escaped with another browser. AllAboutCookies' testers reported that with Net Nanny they could access some restricted content by using a different browser or search engine. Microsoft Family Safety has the same shape by design: its web filtering is strongest in Edge, and other browsers are not integrated the same way, so the usual advice is to block them outright.

Blocklists fail open. A blocklist permits everything it has not been told about. New domains, mirrors and proxies appear faster than any list is updated, so every gap is an unblocked site.

Anything a child can uninstall, they eventually will. Removal doesn't need cleverness, only time alone with the machine.

The bypass methods that actually matter, and the defence for each

Ignore the exotic ones. In practice a handful of moves account for nearly every defeated setup, and each has a specific, boring defence.

  • Administrator rights. The master key. An admin can stop services, edit system files and remove software. Defence: a standard, non-admin child account. Nothing else on this list matters as much.
  • A second or guest OS account. Policy attached to one login does not follow the child to another. Defence: disable the guest account and audit the account list on the machine.
  • An alternative or portable browser. A browser run from a USB stick or a downloads folder never sees your extension. Defence: system-level filtering, not a browser add-on, plus removing install rights.
  • A VPN. Tunnels straight past DNS and network filters. Defence: block VPN installation via a non-admin account; see can a VPN bypass parental controls.
  • A mobile hotspot. Router-level filtering ends where your Wi-Fi ends. Defence: filtering that lives on the device, not the network.
  • DNS-over-HTTPS. Encrypts DNS lookups so your DNS filter never sees them. Defence: application-layer control that decides what may load, regardless of how the name was resolved.
  • Safe mode. Starts Windows with third-party services disabled. Defence: a non-admin account, which cannot change boot options.
  • Uninstalling. Defence: install rights held by the parent only.

Notice how many defences are the same defence.

How the main approaches compare on how they fail

Products differ less than architectures do. Score the architecture and you can predict the complaint.

Approach Typical failure mode Survives another browser? Survives a VPN or hotspot? Survives a non-admin child?
Blocklist filtering Fails open on anything unlisted Depends on where it runs No (VPN) Yes, if system-level
Allowlist filtering Fails closed; over-blocks at first Yes, if system-level Yes, if enforced on-device Yes
Account-level (Family Safety, Family Link) Second account or profile ends the policy Often no No Yes
Device-level / managed desktop app Weak if the child holds admin rights Yes Yes, when filtering is on-device Yes
Browser extension Removed or sidestepped in seconds No No Partially
Router / DNS filtering Stops at the edge of your Wi-Fi Yes No Yes
Monitor-and-alert (Bark-style) Reports after the fact rather than preventing N/A N/A N/A

That last row deserves care. Monitoring tools are not trying to block; that is a deliberate product choice. But it changes what you get. Canopy's comparison argues that Bark alerts you only after a child encounters inappropriate content, and AllAboutCookies' testers reported alerts arriving a full day after the triggering message. If your goal is prevention, an alerting architecture will disappoint you no matter how well it is executed.

What reviewers report about the big five

Reported complaints, attributed - not verdicts on whether the products are defective.

Reviewers of Qustodio repeatedly raise reliability of the things it promises rather than bypasses as such: AllAboutCookies' testers reported no alerts when text content was inappropriate and no geo-fencing alerts when the device left a saved location, and summarised the recurring Trustpilot themes as unresponsive customer service, an unintuitive website and inaccurate reporting.

Bark draws the prevention-versus-notification critique above, plus reports that app blocking doesn't always work and that installed apps are sometimes missing from the blocking list.

Net Nanny attracts the most direct bypass reporting: alongside the different-browser finding, testers reported gambling sites remaining accessible despite being blocked, custom filters not working as intended, and inconsistent YouTube blocking.

Microsoft Family Safety carries the Edge-first architecture and the new-profile report described earlier. See our Microsoft Family Safety alternative breakdown.

Google Family Link has the widest catalogue of documented workarounds, because Android is open. Bitdefender lists ADB commands via Developer Options, hidden browsers reached through WebView, app cloning, Secure Folder, accessibility shortcuts, clock changes and removing the supervised account.

The honest section: where 3Eyes holds, and where it doesn't

3Eyes runs as a managed desktop application on Windows and Mac. Because it is a background service enforcing an allowlist at the system level, it doesn't care which browser your child opens, it fails closed rather than open, and it resists the two most common casual attacks - editing the config file and signing out of the parent account. That is a genuinely different architecture from an extension or an account-level policy, and it is why the allowlist-first approach is worth considering.

Here is the part most vendors bury, and we would rather you read it before you pay: your child needs their own Windows or Mac login, and that login must be a standard user, not an Administrator. If your child signs in as an Administrator, they can stop the background service, uninstall it, or boot into safe mode - and so can they with any other product on this page. There is no software that survives an administrator who is determined to remove it. Anyone claiming otherwise is selling you something.

So the honest framing is this: 3Eyes is not bypass-proof, and no product is. The single highest-leverage step any parent can take, whichever product you choose, is a standard non-admin child account. Do that first. Our Windows 11 parental controls guide and Mac guide both walk through it, and it costs nothing.

What to do when you discover a bypass

Close the technical hole, but don't stop there - a bypass is information, not just a defect.

First, fix the specific gap: check whether the account is still non-admin, whether a new user account or browser profile appeared, and whether anything was installed. Turning off incognito mode is often part of the same cleanup.

Then have the conversation, and lead with curiosity rather than the punishment. What were they trying to reach, and why? A child who spent three evenings researching how to disable a service has demonstrated persistence, capability and a motive - and the motive is the actionable part. Sometimes it is a blocked site they needed for homework, which means your allowlist is too tight. Sometimes it is a friend group on a platform you blocked, which is a conversation about that platform, not about the software.

Say plainly that the controls are staying and why. Then adjust something visible in their favour - a site they asked for, a later cut-off on Fridays. A control system a child sees as negotiable is one they are far less motivated to defeat.

Frequently asked questions

What parental controls can kids not bypass? None, honestly. The most bypass-resistant setup is system-level allowlist filtering installed on a standard non-admin child account, because it survives other browsers, VPNs and hotspots. The account type matters more than the brand you pick.

Can my child bypass parental controls if they are an administrator? Yes, on any product. An administrator can stop services, uninstall software and boot into safe mode. This is why converting the child's account to a standard user is the first step in every serious setup guide, including ours.

Do browser extensions work as parental controls? Poorly, on a shared computer. An extension only sees the browser it is installed in, so a second browser, a portable browser or a different profile sidesteps it. Use system-level filtering instead and keep the extension as a convenience, not a defence.

Is monitoring better than blocking? They solve different problems. Monitoring tells you what happened; reviewers note this can arrive after the content has been seen. Blocking prevents access but gives you less visibility. Younger children generally need blocking; older teens often need visibility plus conversation.

Will a VPN get around device-level filtering? A VPN defeats router and DNS filtering, but not filtering enforced by an application on the device itself. It also usually requires an install - which a standard non-admin account prevents in the first place.

If you want the architecture described above, 3Eyes covers up to four children on one family plan with a 14-day trial - see pricing and set up that standard account before you install anything.