Parental controls are not a set and forget job. Over the past few months HelloTech technicians have been called into homes across Sydney's North Shore and Hills District where the controls were switched on, the parents were doing everything right, and the kids were still online at 1 am. In almost every case the child had not hacked anything. They had found a gap the parent did not know existed.
This article covers the tricks we are actually seeing on real home visits in 2026, why the same fix keeps failing, and the layered setup we now install so the gap closes and stays closed.
What we have been seeing on Sydney home visits
A typical recent job: an iPhone household with three teenagers, a Mac in the study, and parents who had set up Screen Time properly. The parents asked for an audit. Within twenty minutes we found the bedtime limit was being reset with the time zone trick, one child had a second Apple account on an old iPad from a drawer, and the youngest had worked out the Screen Time passcode by watching Dad type it.
None of this needed technical skill. It needed a bored teenager and a house full of screens.
The pattern repeats across suburbs. The devices change, the tricks barely do.
The eight bypasses we see most often
1. The time zone trick (iPhone and Android)
Downtime and bedtime limits use the device clock. If Date and Time is not locked, the child changes the time zone to somewhere hours behind, the limit lifts, and they change it back in the morning. Apple's own developer forums have threads on this exact loophole.
The fix: on iPhone, go to Screen Time, Content and Privacy Restrictions, and lock Date and Time under the system settings section. On Android, put date and time behind the parent PIN where the manufacturer allows it, and turn on network provided time.
2. Guessing or shoulder surfing the passcode
The most common bypass of all. The Screen Time passcode is the parent's birthday, the same as the phone unlock code, or simply seen once. Once a child has it, every limit is decorative.
The fix: a fresh six digit code the child has never seen you type. Change it if there is any chance it has been observed. Make sure Screen Time recovery is tied to the parent's Apple Account, not the child's.
3. Browsers hiding inside other apps
Safari is blocked or filtered, so the child opens links inside Discord, Gmail, Messages or Snapchat instead. Those apps carry their own built in browsers, and Screen Time's web filters do not always apply inside them. The same goes for GIF search inside iMessage and image results inside Spotlight.
The fix: filter at the network level rather than the app level. DNS based filtering blocks whole categories before the page loads, no matter which app opened the link.
4. Guest mode and second user profiles (Android)
Android lets you add a new user or a Guest profile. That profile sits completely outside Family Link. Switch to it, do what you want, switch back.
The fix: in the device settings, turn off Add users from lock screen and disable the multiple users feature entirely. Check the Users screen during your monthly audit.
5. The fake birthday account
A child creates a second Google or Apple account with a birthday that makes them 19. That account is unsupervised from the moment it is created. On Android, Family Link can be told to block adding and removing accounts. Note that Google automatically offers supervised children the option to manage their own account at 13, which surprises a lot of parents.
The fix: block account changes in Family Link, and on iPhone make sure the child is a child account inside your Family Sharing group rather than a standalone account with restrictions bolted on.
6. The drawer device
The old iPad, the retired phone, the smart TV's web browser, the PlayStation browser, a school laptop. Every one of these is a screen with no controls, and every child in Sydney knows where they are.
The fix: an inventory. On a HelloTech visit we walk the house and list every device that can reach the internet. Then it either gets controls, gets wiped and locked away, or gets blocked at the router.
7. The hotspot off a mate's phone
Your router filtering is excellent. It does nothing at all when the child connects to a friend's 5G hotspot, or to the neighbour's Wi-Fi, or to the bus. Since the under 16 social media rules came in, this has become the standard way teens keep their accounts alive.
The fix: on device filtering that travels with the phone. A DNS filtering profile installed on the device itself keeps working on any network.
8. Factory reset
The nuclear option. Wipe the device and the controls disappear with it. On Android this is stopped by Factory Reset Protection and a properly locked Google account. On iPhone it is only truly stopped by Apple supervision through Apple Configurator, which is a different level of lockdown from Screen Time and something we are careful to scope properly with families before recommending it.
Why the single setting approach keeps failing
Think of parental controls like securing a house. Screen Time is a lock on the front door. It is a good lock. But kids do not pick the lock, they use the window you forgot about, the spare key under the mat, or the neighbour's back gate.
One layer will always have a gap. Four layers, each covering what the one above misses, is a different proposition.
The four layer lockdown HelloTech installs
Layer 1: the device. Screen Time or Family Link set up as a proper child account inside the family group. Date and Time locked. Account changes blocked. Guest profiles disabled. A passcode the child has never seen.
Layer 2: the home network. Content filtering on the router itself, plus scheduled Wi-Fi cut off per device. This covers the smart TV, the games console, the old iPad and anything else that joins your Wi-Fi, whether or not it has its own controls.
Layer 3: on device DNS filtering. A filtering profile on the phone or laptop that keeps working on hotspots, school Wi-Fi and mobile data. This is the layer that closes the in app browser gap and the mate's hotspot gap at the same time.
Layer 4: supervision and habits. Factory Reset Protection on Android. For families who need it, Apple supervision on iPhone. And a two minute monthly check: Users screen, accounts list, time zone, device inventory. Plus the part no technology replaces, which is an honest conversation with the child about why the rules exist.
What the Australian social media rules changed
The Online Safety Amendment (Social Media Minimum Age) Act came into force on 10 December 2025 and requires platforms to keep under 16s off their services. In practice it moved the problem rather than solving it. eSafety's three month review found around 58 per cent of under 16s were still using social media daily, barely down from 60 per cent before the ban, and about half of retained accounts had never had an age check.
For parents the lesson is simple. The platforms will not do this for you. The controls that work are the ones in your home, on your network, and on the device in your child's hand.
A realistic monthly parental controls audit
Two minutes, once a month. Check the Screen Time or Family Link report for gaps that do not match what you know. Open the Users or Accounts screen and look for anything new. Confirm the time zone is still Sydney. Walk past the drawer with the old devices in it. Ask the child what is annoying them about the controls, because whatever is annoying them is what they are working on getting around.
When to call HelloTech
If you have set up Screen Time or Family Link and the kids are still finding a way through, you do not need a better app. You need someone to walk the house, find the gaps, and lock all four layers in one visit. That is exactly what a HelloTech parental controls appointment is. A trusted local technician comes to your home, audits every device and the network, sets the layers up in front of you, and leaves you with a plain English summary of what was done and how to keep it that way.
