Why Has My Child Installed a VPN, and What Should I Do?
A VPN app on your child's phone almost always means one of three things: they wanted a game or site that school blocks, they were following a YouTuber's advice about privacy, or they wanted something at home they knew you would say no to.
The first two are ordinary. The third is worth a conversation. But there is a fourth thing you should check either way — a VPN can stop your parental control app from seeing anything, while the app carries on reporting as though it works.
What a VPN does, in one paragraph
A VPN sends all of the phone's traffic through someone else's server before it reaches the internet. Anything watching from the phone's normal network path — a school filter, a home router, most parental control apps — sees one encrypted connection to that server and nothing about what is inside it.
It is not hacking and it is not obscure. There are hundreds of free VPN apps in every app store, many marketed directly at teenagers, and installing one takes under a minute.
Why the free ones are the actual problem
If you take one thing from this page, take this: the risk is rarely what your child wanted to reach. It is the app they installed to get there.
A VPN provider can see everything the free tier is meant to hide from everyone else. Free VPNs are not charities — the ones that make money from advertising and data are making it from your child's traffic, and the ones that do not make money tend to have nobody maintaining them. A child installing a random free VPN to reach a game has handed their entire browsing history to a company neither of you can name.
That is a better conversation to have than the game.
How to tell whether your controls have stopped working
The awkward part of a VPN is that nothing looks wrong. Reports keep arriving, limits still show, and the dashboard stays green. What has changed is that the filtering no longer sees the traffic.
Two checks:
- Look for a key icon in the status bar. Android shows one while a VPN is connected. If it is there and you did not set it up, something else did.
- Check the app list for VPN apps, including ones with names that do not say VPN. Many are branded as "proxy", "unblock" or "secure browser".
There is also a subtler version with no app at all. Chrome and Firefox can send their DNS lookups over HTTPS to their own servers — a browser setting, not an install. Most parental control apps stop filtering the moment it is switched on, and none of them will tell you. We explained the mechanism here.
What to do
Ask what they were trying to reach. The answer is usually a game or a video site, and it tells you whether this is boredom or something you need to know about. Leading with "you installed a VPN" makes it about the rule; leading with "what were you trying to get to" makes it about the reason.
Explain the free-VPN trade, once, plainly. Teenagers respond well to this one because it is a fact about being taken advantage of, not a rule. Most have never been told who pays for a free VPN.
Remove it together rather than quietly. Deleting it behind their back gets it reinstalled within a week under a different name. Agreeing to remove it, and why, usually holds.
Then close the door it came through. If a filter is easy to step around, it will be stepped around again — this time by something you do not recognise.
What KidMoat does about it
KidMoat filters at the DNS level on the device, rather than inside one browser, so it applies to whatever browser is open. It also blocks the public DNS-over-HTTPS provider domains, so a browser that tries to route around the filter falls back to the resolver the filter can see, and it refuses DNS-over-TLS on port 853.
And because the phone is limited by time as well as by site, reaching a mirror of a blocked game does not buy an extra hour. The daily limit and the per-app timer still apply, whatever route the traffic took.
Said plainly: a determined teenager with a device they fully control can defeat any of this, ours included, and any page telling you otherwise is selling you something. What a good setup does is remove the casual routes and tell you when something changed — including when protection is switched off entirely, which KidMoat reports rather than hiding.
KidMoat is Android for now, parent and child both.
Related
- What is DNS over HTTPS, and why does it break parental controls?
- Your child searched "unblocked games" — what that means
- KidMoat vs Google Family Link — a Chrome-only filter is a filter with a side door
- KidMoat vs FlashGet Kids
Related Posts
Your Child Searched "Unblocked Games" — What That Means and What to Do
"Unblocked games" means games reached in a way that gets around a school or home filter. Finding it in a browser history is not a sign of a problem child — it is a sign the filter is being tested. Here is what it means and what actually works.
What Is DNS over HTTPS, and Why Does It Break Parental Controls?
A browser setting, not an app, that can switch off most parental control filtering without anything looking wrong. Reports keep arriving and limits still show — they are just no longer complete. How to check, and what survives it.
What Is Unblocked Games 76, and Should I Be Worried?
A site hosting browser games chosen because school networks have not blocked it yet. The games themselves are mostly harmless — the advertising, the copycat sites and the lost hours are the real issues. What to check and what to do.
See how KidMoat works
Set the day’s limit together, keep distractions out of study hours, and switch to Exam Day in one tap. Works whether the phone is theirs or yours.
See how it works