The simple version first

Every parental control is really just one of four things

🏠
A guard at the front door of your internet
Your router checks every website your kid tries to visit before it loads. If it's on the blocked list, the door doesn't open. Works for every device in your house — phone, tablet, game console, TV. Stops working the moment they leave home.
🕵️
A hall monitor that follows the device everywhere
An app on the device routes all traffic through a parental control server — even on cellular at a friend's house. The server checks everything, blocks what's not allowed, and reports back. Works everywhere, but uses the same "hall monitor slot" all other VPN apps need — only one can be active at a time on iPhone/iPad.
📬
Reading your kid's email and Google account
Your kid gives the app permission to read their Gmail, Google Drive, YouTube, and iCloud email — like handing over a key to their mailbox. The app's AI reads everything looking for warning signs and alerts you. Works anywhere because it reads cloud servers, not the device itself.
🔒
Rules built into the phone itself
Apple Screen Time runs at the operating system level — below every app. No app can override it. You set a PIN, lock down what can be installed, and control screen time. It's the only tool that can scan iMessage photos for explicit content — because Apple built it directly into iOS before encryption happens.
The one thing nobody can do on iPhone or iPad: Read messages inside iMessage, Snapchat, WhatsApp, TikTok DMs, or Instagram DMs. Those apps scramble the message on the device before it ever hits the internet — so the hall monitor, the guard at the door, and the email reader all see gibberish. The only partial exception is Apple's own Screen Time, which can blur nude images in iMessage because it runs inside the phone's own operating system before the scrambling happens.
The 5 Core Mechanisms
Every parental control product is built on one (or more) of these five mechanisms. Once you understand the mechanism, you know exactly what it can see, what it can block, and how a determined kid could get around it — before you buy anything.
🌐
DNS & Router-Level Filtering Network
All traffic passes through the router before reaching any device
When your device asks to visit a website, it first asks a DNS server to look up the site's IP address — like a phone book. A filtering router intercepts that lookup and simply returns "not found" for blocked domains. The device never makes a connection. Because this happens at the network level, it covers every device on your WiFi — phones, tablets, game consoles, smart TVs, guests' phones — with zero per-device setup.

More advanced routers also do Deep Packet Inspection (DPI) — actually reading the content of unencrypted traffic to apply more granular rules. Modern HTTPS makes most content encrypted, but metadata (which domain, how much data, timing) is still visible.

✓ Can Do

  • Block entire websites/domains for every device at once
  • Cover consoles, smart TVs, IoT — things apps can't reach
  • Enforce SafeSearch on Google, Bing, YouTube
  • Ad blocking network-wide
  • No app to install — invisible to kids

✗ Cannot Do

  • Anything once device leaves home WiFi (cellular = bypassed)
  • Read inside encrypted HTTPS traffic content
  • Per-device time limits without additional software
  • Monitor messages, texts, or social media content
Bypass: Switch to cellular data. Use a hotspot. Connect to a different WiFi network. Gryphon's HomeBound VPN closes this gap for iOS/Android devices.
Gryphon AX Circle Home Plus Apple Screen Time (partial)
🔒
VPN Proxy (Device-Level) On-Device
All device internet traffic tunneled through the vendor's servers for inspection
The app installs a VPN profile on the device. All internet traffic — every app, every browser request — is tunneled through the vendor's servers before reaching its destination. At those servers, the vendor can inspect the traffic: block domains, scan images, enforce SafeSearch. Because it's on the device, it travels with the child everywhere — home WiFi, cellular, friend's house WiFi.

Important iOS limitation: iOS only allows one VPN active at a time. HomeBound, Qustodio, Canopy, and Bark's web filter all use this slot. You can only pick one. There's also measurable performance overhead — traffic has to make an extra round-trip through the vendor's servers.

✓ Can Do

  • Works everywhere — cellular, any WiFi, any network
  • Block categories, domains, SafeSearch enforcement
  • AI can scan unencrypted images/video as they pass through
  • One profile covers all browsers and most apps

✗ Cannot Do

  • Read end-to-end encrypted app messages (iMessage, Snapchat, Signal)
  • Coexist with another VPN on iOS
  • Cover consoles or TVs (device-only, not network-wide)
  • Be hidden from a child who knows where to look in Settings
Bypass: Settings → General → VPN & Device Management → toggle off. A teen who knows iOS can find this in under 30 seconds. The app fires a parent alert, but coverage drops immediately. Solution: lock Settings with Apple Screen Time PIN to hide the VPN toggle.
Gryphon HomeBound Canopy Bark (web filter)
🛡️
MDM Profile (Mobile Device Management) Strongest iOS
Enterprise-grade device management — the same technology corporations use to manage employee phones
An MDM profile is a configuration file installed at the OS level in Settings → General → VPN & Device Management. It's the same mechanism corporations use to manage work iPhones. The profile can enforce policies that regular apps cannot override: restrict which apps can run, enforce content ratings, install certificates, and — critically — require the parent's account password to remove.

Qustodio uses both an MDM profile (for device management and app control) and a VPN (for web traffic filtering). This combination is the strongest iOS enforcement available outside of Apple's own Screen Time. The MDM profile does NOT disappear if the app is deleted — the child would need to go to Settings and delete the profile, which triggers an immediate parent alert and requires Qustodio's account password to complete.

✓ Can Do

  • Block specific apps from running system-wide
  • Require parent password to remove the profile
  • Enforce policies that survive app deletion
  • Trigger instant parent alert if removal is attempted
  • Control App Store purchases and downloads

✗ Cannot Do

  • Read iMessage, SMS, or end-to-end encrypted messages
  • Monitor content inside social media apps (TikTok, Snapchat, Instagram)
  • Filter network traffic by itself (needs the VPN component too)
  • Be removed without parent password + alert firing
Bypass: Settings → General → VPN & Device Management → tap the profile → Delete Profile. Requires the parent's Qustodio password. Alert fires immediately. Determined teens have done this within 48 hours — it's doable, but noticeably harder than VPN-only tools. Factory reset also removes it, but that wipes the whole device.
Qustodio (MDM + VPN) Aura (MDM)
☁️
Cloud OAuth & Desktop Sync Monitoring-Focused
Read content where it lives — in the cloud account — not on the device
Instead of intercepting traffic, this approach goes to the source. Cloud OAuth: you authorize Bark to read your child's Gmail, Google Drive, iCloud email, or YouTube account via official API keys. Bark's AI then scans that content in the cloud continuously — no device access needed. Works anywhere because the data lives on Google's/Apple's servers.

Desktop sync is the iOS workaround for on-device content: you run the Bark Desktop App on a Mac or Windows computer. When the iPad is on the same WiFi and syncs (like an iTunes backup), Bark reads texts, photos, and notes from the sync data. The limitation: only works when the device is home, on WiFi, connected to the computer running Bark Desktop. Not real-time. Not available at a friend's house or on cellular.

✓ Can Do

  • Monitor Gmail, Google Drive, iCloud email, YouTube — anywhere, always
  • Deep AI analysis of message content, tone, and context
  • 30+ social platforms on Android (full app access)
  • Zero device footprint for cloud monitoring — no app needed

✗ Cannot Do

  • Monitor iMessage, Snapchat, TikTok, Instagram DMs on iOS (Apple blocks API access)
  • Desktop sync: requires home WiFi + computer running Bark Desktop
  • Block or control what the device can access
  • Real-time alerts for on-device content on iOS (delayed to sync)
Why Apple blocks this: Apple doesn't allow third-party apps to read iMessage, Snapchat, or TikTok data on iOS — this is a deliberate privacy protection. It's the same reason no parental control app can truly monitor in-app social media messages on iPhone/iPad. Android gives apps more system-level permissions, which is why Bark is dramatically more powerful on Android.
Bark (primary mechanism)
⚙️
OS-Native Controls Built-In
Apple Screen Time and Google Family Link run at the kernel level — below all apps
Apple Screen Time and Google Family Link are built directly into the operating system — not apps running on top of it. This means they run at a lower level than any third-party app and cannot be bypassed by any app. Screen Time limits are enforced by the OS itself. Content restrictions are handled before any app even loads.

The key difference from every other mechanism: there is nothing to uninstall. A child cannot delete Screen Time. They cannot disable it from the App Store. The only bypass is the parent's PIN — or a full factory reset, which is hard to hide. When locked with a strong PIN that the parent keeps secret, Screen Time is the most tamper-resistant layer available.

✓ Can Do

  • Enforce downtime/bedtime that no app can override
  • Block entire app categories at OS level
  • Prevent VPN settings from being changed (locks the VPN toggle)
  • Works completely offline, no subscription, free
  • Nothing to install, nothing to uninstall

✗ Cannot Do

  • Monitor content — you set rules but get zero visibility into what was blocked or attempted
  • Alert you when kids try to access blocked content
  • Apply different rules per-app on a granular basis
  • Cover other devices — only the specific iOS/Android device it's set up on
Screen Time's hidden superpower: Setting Screen Time → Content & Privacy → VPN to "Don't Allow" prevents any VPN from being toggled off — including HomeBound, Qustodio, and Canopy. This one setting dramatically reduces the bypass risk of every VPN-based tool. Always configure this when installing any VPN-based parental control.
Apple Screen Time Google Family Link
Product Deep Dives
🔹
Gryphon AX
Mechanism: DNS Filtering + Deep Packet Inspection · Router Hardware

How it works The Gryphon replaces your existing router entirely. Every packet from every device on your network flows through Gryphon's hardware before reaching the internet. Gryphon maintains a continuously-updated blocklist of millions of domains across 50+ content categories. When a device requests a blocked domain, Gryphon's DNS resolver returns a null/blocked response — the request never leaves your home.

Key insight Because Gryphon IS the router, there's no way to "uninstall" it from within the network. A child would have to physically unplug the router and reconnect to a different internet source — which is very detectable. This makes it the most bypass-resistant home network solution available.

HomeBound is a VPN companion app (included with Premium) that creates an encrypted tunnel from iOS/Android devices back to your Gryphon router. When a device leaves home, all traffic still routes through Gryphon — same DNS filters, same rules. Uses the iOS VPN slot. Parent gets an alert if it's disabled.

What it seesiOSAndroidConsoles / TVs
Web domains visited✓ On home WiFi✓ On home WiFi✓ All devices
Off-home via HomeBound✓ With HomeBound✓ With HomeBound✗ No VPN on consoles
Message/text content✗ Encrypted✗ Encrypted
Social media content✗ App traffic encrypted✗ App traffic encrypted
Ad blocking✓ Network-wide✓ Network-wide✓ Network-wide
🔵
Qustodio
Mechanism: MDM Profile + VPN Proxy · iOS & Android App

How it works on iOS Qustodio installs two things: (1) an MDM configuration profile for device management — controls which apps run, enforces time limits, requires parent password to remove; and (2) a VPN profile that routes all web traffic through Qustodio's cloud servers for content filtering and monitoring. Both live in Settings → General → VPN & Device Management.

Plan difference Basic ($59.95/yr, 5 devices): web filtering, app blocking, screen time, location, social monitoring, AI alerts, gaming alerts. Complete ($109.95/yr, unlimited devices): adds YouTube monitoring, 30-day activity history, AI-powered message and search alerts, panic button, app download alerts. For multi-kid families or anyone who wants YouTube visibility — Complete is the right plan.

iOS limitation Qustodio cannot read iMessage, SMS, or in-app messages from Snapchat, TikTok, or Instagram on iOS. Apple does not allow any third-party access to these. The calls & messages monitoring feature on iOS requires running Qustodio Family Portal on a Mac or Windows computer — when the device syncs to the desktop app, call logs and some message metadata are captured. This is NOT real-time and NOT available without the desktop app running.

What it seesiOS (Basic)iOS (Complete)Android
Web browsing everywhere
App usage & blocking
YouTube monitoring
30-day activity history
Social platform alerts⚠ Desktop sync req'd⚠ Desktop sync req'd✓ Real-time
iMessage / SMS monitoring✗ Apple blocks✗ Apple blocks
Location tracking✓ Real-time + geofence✓ Real-time + geofence
🐕
Bark
Mechanism: Cloud OAuth + Desktop Sync + VPN (web filter) · AI Monitoring

Three separate components Bark Premium combines three distinct technologies: (1) Cloud OAuth — you connect your child's Google account, iCloud email, YouTube, etc. Bark reads these via authorized API access, continuously, from anywhere. (2) Desktop sync — Bark Desktop on Mac/Windows syncs texts, photos, notes when the iPad is home on WiFi. (3) Bark Kids VPN app — a VPN-based web filter on the device that travels everywhere. These three components work independently of each other.

Why cloud monitoring is powerful Cloud-based Gmail/Drive monitoring works even when the device is off, broken, or at a friend's house — because the data lives on Google's servers, not the device. A child can't "block" this by turning off their phone. This is why Bark catches concerning emails and Drive documents that other products miss entirely.

Bark Jr vs Premium Bark Jr ($49/yr): screen time, web/app blocking, location tracking only. No AI content monitoring. Essentially a basic controls-only tool. Bark Premium ($99/yr): adds full AI monitoring of cloud accounts, Android social/text monitoring, desktop sync for iOS. Most families need Premium.

iOS fundamental limitation Snapchat, TikTok, Instagram, and Discord do not allow any third-party app to access their message content on iOS — period. This isn't a Bark limitation, it's Apple's privacy architecture. On Android, Bark has full access to these apps via device-level permissions. For an iPad household, Bark's value is cloud accounts (Gmail, YouTube, iCloud email) plus the web filter — not social media message monitoring.

What it monitorsiOS (how)Android (how)
Gmail / Google Drive✓ Cloud OAuth — always-on✓ Cloud OAuth — always-on
iCloud email✓ Cloud OAuth — always-on✓ Cloud OAuth — always-on
YouTube activity✓ Cloud OAuth — always-on✓ Cloud OAuth — always-on
SMS / iMessage⚠ Desktop sync when home✓ Real-time device agent
Instagram, TikTok, Snapchat✗ Apple blocks access✓ Real-time device agent
Web browsing filter✓ VPN — everywhere✓ VPN — everywhere
Photos / notes⚠ Desktop sync when home✓ Real-time
🌿
Canopy
Mechanism: VPN Proxy + AI Computer Vision · Content-Blocking Focused

How the AI scanning works Canopy's VPN routes all device internet traffic through their servers. As images and video frames pass through, Canopy's computer vision model analyzes them in real-time for explicit content — nudity, sexual content, suggestive imagery. This happens before the content reaches the screen. If an explicit image is detected, it's replaced with a block screen and the parent is alerted.

Sexting prevention Canopy can detect explicit images being sent or received through any channel that passes through its VPN — browsers, most apps. The caveat: end-to-end encrypted apps (iMessage, Snapchat, Signal) encrypt their traffic before it hits the VPN tunnel. Canopy cannot scan inside that encrypted payload. So sexting detection works on browser-based sharing, web apps, and some non-E2E channels — but NOT iMessage or Snapchat on iOS.

Family plan Individual plan = $7.99/mo (3 devices, billed annually). Family plan = $9.99/mo (10 devices, billed annually). For families with multiple children, the Family plan is necessary and still less than Qustodio Complete or Aura.

Data usage warning Because ALL device traffic routes through Canopy's servers — including video streaming — it can consume 10–13 GB of cellular data per month on an active device. For families on limited data plans, this is a real cost to factor in.

What it doesiOSAndroid
Explicit image blocking (browsers)✓ AI real-time✓ AI real-time
Sexting detection (browser/web)✓ Via VPN scan✓ Via VPN scan
Sexting in iMessage/Snapchat✗ E2E encrypted — invisible to VPN⚠ Limited
URL / domain filtering✓ Everywhere✓ Everywhere
Location tracking✓ Real-time + geofences✓ Real-time + geofences
Social monitoring (browsing context)⚠ Web-based content only⚠ Web-based content only
Message/text content
App blocking⚠ Unreliable on iOS
🌐
Aura
Mechanism: MDM + Identity APIs + PC Agent (Safe Gaming) · Hybrid Platform

Three separate systems in one subscription Aura bundles three independent technology layers: (1) Parental controls — MDM-based device profile on iOS/Android for content filtering, screen time, app blocking; (2) Identity protection — API connections to the three major credit bureaus plus dark web scanning for SSNs, passwords, financial accounts; (3) Safe Gaming — a Windows PC desktop agent that hooks into game audio/video output to monitor voice and text chat.

Parental controls on iOS Uses an MDM profile (similar to Qustodio) for device management: content filtering via SafeSearch, app blocking, screen time schedules, internet pause. Activity reports show browser history and app usage. Requires iOS 16+. No location tracking — Aura's parental controls do not include GPS/location features.

Safe Gaming is unique No other product in this comparison monitors gaming voice chat. The Windows desktop agent runs alongside games and uses AI to analyze conversations in 200+ PC games — flagging predatory language, threats, and grooming attempts. Reports are weekly, not real-time. Windows only — does not work on consoles, iPad, or Mac games.

Plans Kids Plan ($10/mo annually, $120/yr): parental controls + safe gaming + wellbeing tools. Family Plan ($32/mo annually, $384/yr intro, renews ~$35/mo): adds identity theft protection for the whole family — credit monitoring, $5M insurance, antivirus, VPN, password manager. Aura also owns Circle Home Plus, whose network-filtering tech is integrated into the Family Plan.

What it doesKids PlanFamily PlanPlatform
Content filtering / app blockingiOS 16+, Android
Screen time / schedulesiOS 16+, Android
Activity reportsiOS 16+, Android
Safe Gaming (voice/text in 200+ PC games)Windows PC only
Location tracking
Identity theft protectionCloud-based
Credit monitoring / dark web alertsCloud-based
Antivirus / VPN / password managerAll platforms
Which Mechanism Wins — By Scenario
All five products block adult and explicit content as a baseline — pornography, violence, and harmful sites are filtered by every option in this table via URL/category blocking. The rows below show where they differ, not whether they have basic content protection. "No" on a row means that specific capability isn't present — not that the product offers no protection at all.
Scenario Gryphon + HomeBound Qustodio Complete Bark Premium Canopy Aura Family
Adult content blocking (baseline — all products) URL + category URL + category URL + category URL + AI visual URL + category
Kids at home on WiFi Strong Strong Web filter only Strong Strong
Kids at friend's house / cellular HomeBound VPN Device profile Web filter VPN Device VPN Device profile
Game consoles / smart TVs Network level No No No No
Instagram / TikTok DM monitoring (iOS) No No (Apple blocks) No (Apple blocks) No (E2E encrypted) No (Apple blocks)
Gmail / cloud account monitoring No No Best-in-class No No
AI visual image scanning (beyond URL blocking — scans actual image pixels) No — URL only No — URL only No — URL only Yes — AI scans every image No — URL only
PC game chat monitoring No No No No Safe Gaming (Windows)
Location tracking No Real-time + geofence Real-time Real-time + geofence No
Tamper resistance (iOS) VPN alert if off MDM + password req'd VPN removable Anti-tamper VPN MDM profile
Identity / credit protection No No No No Family Plan
Annual cost (comparable tier) $89.99/yr + $299 hardware $109.95/yr $99/yr $95.90/yr (3 devices) $384/yr (family, intro)
One-Line Verdict
Gryphon + HomeBound
Router + VPN
Best at
Protecting every device in the home — TVs, consoles, every phone on WiFi — without touching any individual device; HomeBound extends it everywhere the iPad goes.
Struggles with
No monitoring or alerts — you block categories but don't see what your kid tried to access, where they are, or what they're communicating.
Qustodio Complete
MDM Profile + VPN
Best at
The most complete on-device control — MDM protection, per-app time limits, location tracking, and reporting that travels with the device on cellular, everywhere.
Struggles with
Can't read any message content on iOS; call and text monitoring requires a Mac/Windows desktop app running at home; not a set-and-forget tool.
Bark Premium
Cloud OAuth + Desktop Sync
Best at
Catching real warning signs in Gmail, YouTube, and Google Drive — its AI flags only what's concerning without reading everything, which makes it the right tool for teens where privacy matters.
Struggles with
Almost no real-time protection on iPad away from home — it's a monitoring and alerting tool, not a blocker; device content only syncs when back on home WiFi.
Canopy
VPN + AI Visual Scan
Best at
Visually scanning images as they load in browsers — catches explicit photos on sites that aren't on any block list, which URL-based tools miss entirely.
Struggles with
Can't see inside iMessage or Snapchat; app blocking unreliable on iOS; consumes significant cellular data; best as an add-on layer, not a standalone solution.
Aura Family
MDM + Identity APIs + Safe Gaming
Best at
Protecting the whole family's identity (credit monitoring, dark web alerts, $1M insurance) and monitoring PC game chat on Windows — two things no other product in this list does.
Struggles with
No location tracking; parental controls less robust than Qustodio; priced for identity protection first — child safety features are secondary to its core offering.
The Big Picture
No single product covers everything. Gryphon covers your home and consoles. Qustodio/HomeBound covers devices away from home. Bark covers cloud accounts and Android social media. Canopy covers explicit visual content. Aura covers identity and PC gaming. The best stacks combine two or three mechanisms to close each other's gaps.
On iOS, nobody can read Snapchat, TikTok, or iMessage content. This is Apple's privacy architecture — not a vendor limitation. Any product that claims to "monitor Snapchat on iPhone" is either misleading or using accessibility features that Apple has been progressively locking down. Set the right expectation with parents upfront: iOS visibility is web-focused, not app-message-focused.
The most bypass-resistant iOS stack: Screen Time PIN locked → VPN restriction enabled in Screen Time → Qustodio MDM + VPN installed. To bypass this, a child would need the Screen Time PIN AND the Qustodio account password AND be willing to factory-reset their device. This is the gold standard for younger kids where trust isn't yet established.