If your child has started disappearing into a phone that suddenly ignores the website filter you set up last month, a VPN is the most likely culprit. One free download — sometimes installed in under a minute from the App Store, Play Store, or a sideloaded APK — can route all of their traffic around your DNS filter, your router rules, and even school Wi-Fi controls. This guide walks through the full playbook for both Android and iPhone: detecting a VPN that is already on the phone, blocking apps that slipped through, locking the app store so the next one cannot reach the home screen, filtering VPN download pages on the web, and keeping the block holding over time. If Family Link keeps coming up short on this, Google Family Link alternatives map the gaps.
A VPN, short for virtual private network, reroutes a phone's internet traffic through an outside server. To the child it looks like a one-tap switch that unlocks blocked sites, school Wi-Fi restrictions, age-gated apps, or region-locked YouTube videos. To the parental control tool, that traffic is now encrypted and tunneled — so the website filter that worked yesterday quietly stops mattering.
It helps to separate two very different kinds of VPN before you start pulling switches:
Parent-installed filtering VPN. Some parental control and school MDM tools route traffic through their own VPN profile to enforce category filters. This is the one you want to keep.
Child-installed third-party VPN. A free 'turbo,' 'super,' or 'ultra' VPN downloaded from the store or sideloaded as an APK. This is the loophole to close.
Blocking VPN install matters more than tightening any single content rule because one VPN undoes every other restriction at once. Common signs a kid is already shopping for one:
Search history with 'free VPN,' 'best VPN for school,' or 'VPN APK'
Repeated visits to APK mirror sites or 'best free VPN' review hubs
Sudden return of YouTube or TikTok during downtime windows you set up
New configuration profile entries in iPhone settings the child cannot explain
Sideloaded APKs with generic names like 'VPN' or 'Proxy'
Also pull the App Store or Play Store install history — a VPN that was uninstalled an hour before you looked still appears there. If you find one, talk to the child first. Pulling a switch with no conversation tends to push the next attempt underground.
Lock the store side so the next VPN never reaches the home screen.
On iPhone:
Settings → Screen Time → Content & Privacy Restrictions → iTunes & App Store Purchases.
Set Installing Apps to Don't Allow, or to Allow with a Screen Time passcode the child does not know.
Under Content Restrictions → Apps, set the age rating to 12+ or lower — many VPN apps are rated 17+ and will disappear from store search.
Verify the child does not have your Apple ID password; reset Family Sharing if needed.
On Android:
Open Family Link → child's profile → Controls → Google Play → require approval for All apps.
Turn on purchase approval on the same account.
On the device itself, open Settings → Apps → Special app access → Install unknown apps. Set every browser, messenger, and file manager to Not allowed. This kills APK sideloading.
Make sure the child does not know the Google account password — if they do, change it and re-link Family Link.
Confirm the child cannot reach a second account that is unsupervised, such as a school Google account, an iCloud alias, or a friend's Apple ID logged in for 'just one game.' Those are the most common bypasses. A website and app blocking layer catches the VPN that slips through anyway, flagging the install or proxy site no matter which account it came from.
Blocking installs alone does not stop a child from researching workarounds, copying a configuration profile from a friend, or using a browser-based proxy.
Add the highest-traffic free-VPN review pages and APK mirror sites to your router or parental control URL blacklist. Common targets include 'best free VPN' listicles, APKPure-style mirror pages, and configuration-profile sharing sites.
Turn on Safe Search in the default browser. On Google, this strips many working VPN download links from results.
Enable the adult and gambling category filters in your parental control. Many free VPN landing pages share ad networks with those categories, and category-level rules catch sites you would never find by hand.
Watch for browser-based and extension-based VPNs — proxy sites that work without an install, and in-browser VPN extensions on desktop Chrome or Edge that an older child may bring back to the phone via account sync.
The OS steps above work, but they leave you running two playbooks — one for iPhone, one for Android — and re-checking both every few weeks. A dedicated parental control app pulls the same controls into one dashboard. NexSpy is built around exactly that gap.
The NexSpy App Blocker lets you tap any installed app on the child's phone and switch it off. Use it for the VPN names you spotted in Step 1:
Instant block for a VPN you just discovered, so it stops working the moment you confirm it.
Scheduled block for school hours and bedtime, in case the child only fires the VPN up to dodge downtime.
Re-block in seconds if the child uninstalls and re-downloads under a different name.
The per-app block is the piece manual OS settings get clunky with. Instead of opening Screen Time or Family Link every time a new VPN appears, you tap the new entry in the NexSpy app list and switch it off — same workflow on Android and iOS.
Step 3 above relies on App Store and Play Store passcodes. NexSpy adds a second gate on top: the child request-permission flow. Whenever the child wants to open an app NexSpy has restricted, they send a request that lands in your parent dashboard. You approve or deny it from your phone. An unknown VPN cannot quietly open in the background — it has to come through you first, and you see what the child is asking for in plain text.
A child who cannot install a VPN often pivots to 'find a working proxy site' or 'best free VPN APK 2026' instead. NexSpy's Website Restrictions handle that side:
Add the specific free-VPN review pages, configuration-profile sharing sites, and APK mirror domains to the custom URL blacklist.
Turn on the adult, drugs, violence, and gambling category filters. The ad networks behind many free VPN landing pages cross over with those categories, so a single category toggle takes out sites you would never list by hand.
Allowlist legitimate work or school domains the category filter is too aggressive on.
Most 'free VPN download' research starts in a search bar. NexSpy enforces Safe Search across Chrome, Edge, Firefox, Opera, Samsung Internet, and Safari, so the results page itself stops surfacing working download links. On the optional in-app browser, Safe Search is permanently on and cannot be flipped off by the child.
Once the rules are in place, you want a way to check whether the child kept trying. On Android, NexSpy includes browsing history review — you can see whether 'free VPN' or APK mirror sites are still being searched, and follow up with a calm conversation instead of guessing. This is the loop the manual OS steps do not give you: rule, evidence, conversation, adjust.
Many families run an iPhone for one kid and an Android for another, or the same kid switches between an old Android and a new iPhone every couple of years. NexSpy keeps the App Blocker, request-permission flow, URL blacklist, category filters, and Safe Search in one Parent Dashboard across both platforms — so you are not re-learning the steps every time the device changes.
A few honest limits worth keeping in mind: browsing history review is Android only, some app blocks depend on the OS version and the permissions you granted during setup, the optional in-app browser is what permanently enforces Safe Search while other browsers depend on platform-level enforcement, and new VPN apps appear constantly — so the custom URL blacklist is worth a quick review every couple of months.
A VPN block is not a one-time setup. The apps update, friends share new tricks, and the child grows older.
Have an explicit conversation about why VPNs are blocked. 'So you can lie about what you're watching' is the rule the child assumes; 'so the family filter does what we agreed on' is the rule you actually want.
Re-check the VPN section in Settings and the installed app list every two to three weeks.
Watch for new tactics: in-browser proxies, peer-to-peer 'free internet' apps, friends AirDropping configuration profiles, or a school-issued device that comes home without your rules on it.
Plan to relax the block as the teen gets older. A 16-year-old who needs a VPN for a legitimate reason — a privacy class, travel, a school project — is a different conversation than a 10-year-old searching for 'VPN for TikTok at school.'
Frequently asked questions
Can my kid still bypass parental controls if I block VPN apps but they use a browser proxy?
Yes, this is the most common bypass once app installs are locked. Browser proxies and in-browser VPN extensions work without installing anything to the home screen. Close that gap with URL blacklisting of known proxy sites, the adult and gambling category filters, and Safe Search across every browser on the device.
How do I tell if the VPN on my child's iPhone is from their school or a content filter I forgot about?
Open Settings → General → VPN & Device Management and tap the active profile. A school or MDM profile will name the issuing organization and usually carries an 'installed by' line referencing the school's device management system. A child-installed VPN names a consumer app (Turbo VPN, NordVPN, etc.) or carries a generic profile name with no organization attached.
Does turning off Always-on VPN on Android delete the VPN app?
No. Always-on VPN is just the toggle that forces all traffic through whatever VPN profile is selected. Turning it off stops the auto-reconnect, but the app itself is still installed and can be opened manually. Uninstall the app, or block it with the App Blocker, to fully close it.
Is it legal to block a VPN on my child's phone?
In most jurisdictions, yes — parents and legal guardians of minors are generally allowed to set rules on the devices they own and pay for, including restricting which apps and sites are reachable. Laws vary, the framing here is general guidance rather than legal advice, and the rule of thumb is to keep changes transparent with the child rather than covert.
Stop TikTok notifications on iPhone, Android, and desktop with this parent's guide — plus what to do when your teen keeps flipping the toggles back on.
