A parental-controls access audit should identify every adult who can change settings, every child account under supervision, every signed-in device, and every service the controls actually cover. Review authority and coverage separately: a person may have parent privileges, while a particular device or app remains outside that platform’s enforcement.
Map family roles and accounts
Record the family manager, each parent, each supervised child account, the recovery owner, and the date each role was last reviewed. Google explains in its parent-privileges guide that parents can manage a child’s Family Link settings, while only the family manager can add or remove family members and add or remove a second parent. Confirm who holds each role; do not infer authority from who owns or pays for a device.
Check for adults who no longer need parent privileges, duplicate family groups, child accounts signed into the wrong profile, and recovery methods controlled by someone unavailable. Make role changes only through the supported family-management workflow and only with the responsible adult’s approval.
Inventory devices and control coverage
List each phone, tablet, Chromebook, console, computer, browser profile, and game account used by the child. For each, record the account signed in, supervision state, operating system, last sync, and which rules are expected to apply: screen time, app limits, app permissions, web filters, purchases, location, communication, or content ratings.
Coverage varies by device. Google’s iPhone and iPad guidance states that most Family Link supervision settings do not work when a child is signed into Google apps on iOS, including screen-time limits, device location, app activity, app blocking and permissions, and Chrome restrictions. Mark unsupported paths explicitly rather than treating an unchecked setting as enforced.
Audit app-permission authority
For supervised Android and Chromebook devices, review camera, microphone, location, contacts, storage, and other app permissions where relevant. Google’s app-permissions guide says Family Link can set whether only parents or both the child and parents may grant app permissions. It also warns that choosing parents-only does not revoke permissions already granted. Inspect current app permissions as well as the rule for future approvals.
Test from both sides
Use a harmless test app or setting. From the child device, attempt the restricted action and request approval. From the parent device, verify the request appears under the expected child and device, apply the approved test change, confirm the child device receives it, and then restore the original setting. Test offline and after restart if those states matter to the household.
Review purchase approvals, content filters, communication permissions, location sharing, and account recovery independently. A successful screen-time test does not prove purchase or chat controls work. Game and console accounts may have their own family roles beyond the mobile platform. Record those separately.
Finish with a dated matrix of adult role, child account, device, control, expected result, observed result, unsupported paths, and next owner. Avoid recording passwords, recovery codes, precise location history, or private child activity in the audit. The outcome should be a map of verified authority and coverage, not a dossier of the child’s behavior.