Attempting to control Youtube access on Android

It's a problem that our parents didn't really have to contend with - easy, unlimited access to a massive library causing massive amounts of screen time.

We used to get complaints about the amount of time spent watching TV (or on a gameboy), but the library available to us was quite limited, so there was a point where you just stopped watching and did other things for a while (assuming we weren't outright kicked out of the house and sent to the park).

The Problem

Now though, not only is content just a click away, but it's actively pushed to us and our kids.

It's not just the distribution mechanisms, social media is deliberately designed to be immersive and even addictive. In ye olden days, we'd get an episode of what we wanted, but then something completely unrelated would come on - nowadays the approach is much more take this, this, this, oh and you might be interested in this. It's very easy to lose track of the time you've spent, even as an adult.

Littlun has, over time, developed something of a Youtube habit.

That's led to some good conversations about not over-trusting content creators, which seem to have been well absorbed (in the sense that the content being watched is more appropriate, even if I do think some of the streamers are complete wazzocks). We've also had conversations about the importance of talking to an adult if something unpleasant/inappropriate comes up.

So, my concern now isn't so much the content as the time spent on Youtube (given the chance).

That's a much harder issue to resolve through conversation alone, as it's easy to be unware of time spent absorbed, and services like Youtube are designed to exploit that.

What this means is that as well as conversations, some technical measures are required, including

  • a prompt/reminder about the time spent
  • a means to block access

The latter being the "big stick" that I can reserve use of, in order to encourage mini-me to pay a bit more attention to the former.

Blocking Youtube on the LAN is simple (Pihole to the rescue), but it's an incomplete solution. At some point, Littlun'll notice that Youtube works when out and about and realise that the block can be circumvented at home by turning wi-fi off.

This post details the way's I've looked at to help control/restrict Youtube access on Android in a way that doesn't simply disappear with a change in network connection

I need the controls to go with the phone, so realistically that means it needs to be an app. Searching around yields a variety of options.

Famiguard

As a turn-key solution, there's Famiguard, but I'm really not comfortable with it.

Not only is it a paid service, but it's got undesirable features: I want to control/restrict Youtube access, not give a 3rd party the ability to track the phone.

Unfortunately, if you search "How to restrict youtube on my kids phone" you'll likely see lots and lots of sites recommending Famiguard. Reading over their site, though, sometimes the cure really is worse than the disease.

Blocksite

Blocksite allows you to block domains and apps, but the reviews are full of complaints of it failing.

There's absolutely no point in a control that'll silently fail, I need something that's robust.

Google Digital Wellbeing

As it was available on the phone, I had a play with Google's Digital Wellbeing app.

I hit a sticking point almost immediately: we use a Google Apps for Domains (or Workspace or whatever they're calling it today) domain for our Google accounts, so when attempting to set up Family Link, Google returns Can't supervise this account. This type of account can't be supervised. To continue, choose another account. Helpful... Unfortunately, it's a common trend with using an AfD account. For example, if you've a NEST thermostat, then you can share it with family in Google Home but cannot share it with AfD accounts. You can migrate off AfD, but not without losing all of your Play purchases - so you're locked in and locked out.

It seems I'm not the only person to want to use both GSuite (oh look, another name) and Family Link.

But, all this turns out to be fairly moot - Google will only allow you to exercise parental control via Family Link until the child turns 13. That's just surrendering when the battle's only half fought.

Google's Digital Wellbeing is no good to me as a parental control, but it can perhaps still be used to help limit screen time.

  • Settings
  • Digital Wellbeing and Parental Controls
  • Digital Wellbeing
  • tap the graph
  • Find Youtube in the list
  • Tap App Timer
  • Set desired limit

When the set limit is reached, the app will pause. The timer'll reset overnight and the app will be available again.

That's a fairly effective means of limiting the amount of time spent watching Youtube videos, but, it'll only take a poke through the menus (or stumbling on this post) for that limit to get reset or disabled.

I wanted to be fair to Google, thinking that perhaps the parental controls are quite robust and that it's just unfortunate it's undermined by their ongoing Jekyll-Hyde over Apps for Domains (G Suite/Workspace/Tomorrow's name).

So, I created a couple of Gmail accounts to test it, and was promptly disappointed.

The controls lack granularity (in fact, one might say they've been over-simplified to death)

Youtube content controls

In true Google fashion, the controls they provide are also spread across a range of different services, managed through different subdomains, each with their own individual privacy policy.

The Youtube one seems to imply that Google'll be geolocating your kid whether you like it or not

Youtube Family Link Location info

I've no less an issue with Google doing it than I do with Famiguard.

To summarise, the conclusions I've drawn on Digital Wellbeing are:

  • Can't use it with our AfD accounts
  • Without parental control enabled, controls are trivially overridden
  • Parental controls, when active, lack granularity
  • ToS for parental control comes with some serious privacy baggage, including location tracking

Google Apps for Domains

Google's Admin panel provides a list of apps and whether they're permitted for users in my mail domain

Google additional services

So, I wondered if I could implement the big-stick using that.

Going through that menu, you get two choices

  • ON for everyone
  • OFF for everyone

which isn't what I want.

You can't turn on/off for just a single user, but can for a group, so I created a group called "Youtube allowed", enabled Youtube for that group, and then disabled Youtube for everyone else.

Except, it's not very effective, because as Google notes

Changes may take up to 24 hours to propagate to all users.

So much for that then.... you can't really deliver a bollocking with "and I'm blocking your Youtube access, sometime in about the next 24hrs"

Microsoft Family Safety

I've a long-lived distrust for Microsoft and their products, borne out by years of their behaviour, so I really didn't want to go here, but, it can't be any worse than the rest of the market...

Actually, it turns out that Microsoft Family Safety provides exactly the controls I was looking for: I can restrict time in specific apps and set a window that that time can be used within

Google additional services

As an added bonus, you can set different values for weekdays and weekends, so I could allow a little longer at the weekend.

It also has the big stick: blocking an app is trivial, and when tested took effect in seconds.

I can view how much time has been spent in each app and location sharing is optional and off by default.

Management is also quite convenient, it can be done via browser, or through an app.

It's not perfect, when I first set it up on littlun's phone, the web interface kept prompting me to add a device - I had to sign out of the app and sign back in for it to show up.

I really didn't want or expect to find myself using a MS tool, but all credit to them, it seems to be the best solution, by far.


Conclusion

I've written in the past, sometimes at length, about the importance of not relying on services/providers to make the internet kid-safe, and instead enacting local controls. The problem is, over time, it's become increasingly difficult to actually implement those controls in a meaningful way and stem the flow of crap flowing into kids minds.

Although implementing network level controls is easier than it's ever been, i's only of any help whilst connected to the network. Eventually, the realisation that it all works on mobile data will land, and you're back to no real controls.

There should be a middle ground somewhere between "you can watch Youtube" and "I'm taking your phone away", just as there definitely should be a middle ground between "you have unrestricted access" and "I've installed stalkerware allowing a 3rd party company to track your every movement so that I can control your screen time".

Unfortunately, frustration at not being able to easily implement simple restrictions is also easily weaponised into support for much more extreme and flawed plans like age-gating half the internet. It's much easier to convince someone that we should filter the entire internet if they feel that they have no control themselves. Come to that, it also makes it a lot easier to sell them some shady over-collecting solution.

Most of the market for child safety controls seems to consist of products which insist on tracking rather than protecting kids.

All I wanted was to be able to set limits, and when they're flaunted say "right, you're banned from that app" and enforce that. It's a pretty minor ask, blending parenting with technical enforcement, and absolutely should not require me to consent to my kid being tracked.

Google's tooling is flawed, feels half implemented, and undermined by their insistence on excluding AfD users from certain feature-sets. Even when you use a "supported" account, their parental controls are put to shame by Microsoft's solution.

Microsoft seem, at least on first blush, to have delivered the most suitable tool - it provides granular control without being overbearing or collecting unnecessary data. I fully expect, of course, to have to write a new post (or at least a tweet) dealing with some frustration I've discovered with it.

It's a project and a post for another day, but this exploration has convinced me that it's also time to push on with breaking the Google addiction, our AfD accounts are already being blocked out of functionality - if we've got to suffer the loss involved in an account migration, why would I migrate us back into Google's arms?