Google Family Link

Is Google Family Link safe?

For a parent whose child uses an Android phone or a Chromebook, Family Link is a sensible and free set of controls, and its safeguards for the child are better than its reputation. Google does not show children personalised ads, the app shares nothing with outside companies according to its Google Play listing, and the parent can see and delete what is collected. We score it 66/100, close to YouTube Kids (69) and well ahead of Life360 (48).

The weak points are different from those of most kids' apps. Family Link is a key to a whole Google account, so the child's searches, voice requests and location flow to Google as they would for an adult, minus the ad profile. It does nothing on an iPhone. And in 2026 it was turned against adults: someone with your password could make your account a "child" account and lock you out.

What parents can and cannot see

Family Link is about rules and signals, not reading. According to Google's setup guide, a parent can:

• set daily screen time limits, bedtimes and per-app limits, and lock the device remotely
• approve or block app downloads and purchases, and change app permissions
• block sites and restrict mature content in Chrome, Search and Google Play
• see the location of the child's Android device or compatible Fitbit
• change the child's account settings, reset the password or delete the account

What a parent does not get is the content: Google describes no view of messages, chats, emails or photos. Purchase approvals only cover Google Play's own billing, so money spent through a game's own payment system is not caught. Google Workspace for Education accounts, the ones schools issue, cannot be managed through Family Link at all.

Google also says plainly that the Google services a supervised child can open "generally aren't designed for children". Family Link narrows what reaches the child; it does not turn Search or Chrome into a children's product.

What Google collects about your child

Apple's privacy label for the Family Link app lists no data used to track you across other companies' apps. It does list a long set of data linked to the parent's identity, including contacts, audio, photos or videos, payment info, physical address, phone number and device identifiers, and email used for Google's own marketing. The Google Play listing says device identifiers and app interactions are used for advertising or marketing, and that no data is shared with other companies.

The child's side is covered by a separate privacy notice. Google says it collects the child's search terms, the videos they watch, voice recordings when they use audio features, synced Chrome history, and location from GPS, Wi-Fi and cell towers. The key protection is one sentence: "Google prohibits personalized advertising to minors." Ads can still appear, based on the page being viewed, an active search or the child's city, and ads from other companies on non-Google sites are outside Google's rule. The parent can choose whether the child may change activity controls such as Web & App Activity.

The 2026 account takeover

In May 2026 a software engineer writing as Techwolf12 published an attack seen against a friend. The attacker first obtained the victim's password, through a breach or phishing. They then changed the account's birth year to under 13 and linked it to a "parent" account they controlled. From then on, recovery screens asked the victim to get permission from their "parent", and the attacker could see the victim's location, lock their Android phone and read incoming email, including password reset messages.

Two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary did not reliably stop it, according to the write-up, because cookie-stealing malware skips it and the age change did not ask for a second factor. Privacy Guides reported that several victims needed Google's support staff to recover their accounts. We found no public statement that Google has closed the gap. Google's Advanced Protection Program does block it, because those accounts cannot join a Family Link group.

When your child turns 13

At 13, or the local age of consent, Google emails both parent and child. If nobody acts, the existing supervision stays. Google's page on this transition says that children need parent approval to stop supervision until they turn 18, and that both sides are notified when it ends. Another Google help page, on creating accounts, still says a child over 13 can stop supervision at any time, with their supervised devices locked for a while. Treat the teen years as a negotiation, not a switch.

How to use Family Link safely

1. Turn on Google's Advanced Protection Program, or at least a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, for your own account. Your account controls the child's, and the 2026 exploit shows what a stolen password allows.
2. Set the child's Play content rating and require approval for every new app, rather than only for paid ones.
3. Block in-app payments inside games separately, since Family Link only approves Google Play billing.
4. Review which activity controls the child can change, and switch off Web & App Activity if you do not want voice recordings saved.
5. On an iPhone, use Apple's Screen Time instead; Family Link will not supervise it.

How we scored it

The regulatory record (88) is the strongest factor: no fine or order names Family Link. Transparency and control (74) reflects detailed parent controls and full access to the child's data. Security (66) is held back by the 2026 takeover method, which we found no fix for. Privacy (52) is the weakest, because a supervised account still feeds Google a wide set of the child's activity, even without personalised ads.