Interactive Troubleshooter

Published: Oct 16, 2026

Google Family Link Not Blocking Apps? Here's How to Fix It

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

Exhaustive diagnostic tree and repair protocol for Google Family Link app blocking failures. Resolves background synchronization stalls, Usage Access permission bypasses, Knox/OEM battery optimization kills, and Google Play Services cache corruption.

Full Diagnostic Tree & Step-by-Step Overview

What specific behavior do you observe when Family Link fails to block an app on the child's device?

Newly blocked or restricted apps remain accessible on the child's device without any block screen
Apps are blocked momentarily, but the child bypasses restrictions using system tricks or alternative launchers
App limits work on Android, but fail on Chromebooks, iOS, or web browser versions of apps
The Family Link parent app shows 'Device Not Connected' or fails to sync settings entirely

How is the app state displayed in the Family Link Parent app versus the child's physical device?

Parent app shows the app as 'Blocked', but the child device launches it without restriction
App is set to 'Always Allowed' in Family Link policies or listed under exempted system apps
Changes made in the Parent app hang endlessly on 'Saving...' or fail to update the policy profile
The app was sideloaded via an APK, installed via Secure Folder, or created under a secondary Android profile

Which bypass vector or method is being used on the child's device to circumvent the block screen?

Bypassing restrictions via Google Play Store uninstallation/reinstallation or app clearing tricks
Changing device system date and time zone to reset daily screen time allocation timers
Using Notification shade shortcuts, widget popups, or multi-window split screen to launch app activities
Disabling 'Usage Access' or 'Display Over Other Apps' permissions in the child device settings

On which secondary operating system or platform is the Family Link policy failing to enforce?

Chromebook (ChromeOS) environment where Android app limits do not restrict PWA/Web browser access
iOS / iPadOS device where Family Link parental control capabilities are natively restricted by Apple

What network or background service condition exists on the child's supervised device?

Aggressive OEM battery optimization (Samsung, Xiaomi, OnePlus) is killing Google Play Services in the background
Firebase Cloud Messaging (FCM) push notification tokens are stale or blocked by a VPN/DNS filter

Clearing Google Play Services Cache and Refreshing FCM Policy Sync

Solution:

Root Cause: Stale Firebase Cloud Messaging (FCM) Tokens & Local Cache Lock

When a parent sets an app to 'Blocked' in Google Family Link, the parent device pushes a command via Google Cloud Messaging / Firebase Cloud Messaging (FCM) to the child's device. The local com.google.android.gms (Google Play Services) process intercepts this push payload and triggers the parental control overlay. If the local GMS cache is corrupted or FCM push tokens have desynchronized, the child's device ignores remote policy updates while the parent app falsely reports success.

Diagnostic Verification:

On the child's device, open Settings > Apps > Google Play Services.

Check the memory footprint and background data usage. If background data is restricted or the last sync timestamp in Family Link > Device Details is outdated, the sync pipeline is stalled.

Step-by-Step Fix:

1Force-Stop and Clear Google Play Services Cache on Child Device:

Go to Settings > Apps > Google Play Services.

Tap Force Stop, then go to Storage > Clear Cache.

Tap Manage Space / Clear All Data (this will not delete personal files, but forces GMS to re-authenticate with Google servers).

2Clear Cache for Parental controls (GMS Core):

Go to Settings > Apps > Parental controls (or Google Family Link child/teen if listed separately).

Select Storage > Clear Cache and Clear Data.

3Force Policy Resync:

Reboot the child's device and ensure it is connected to an active Wi-Fi or cellular network.

On the parent device, open Family Link, select the child profile, navigate to Controls > App limits, toggle any unrestricted app to Blocked, and wait 30 seconds to confirm the block screen appears on the child device.

Prevention & Long-Term Monitoring:

Ensure the child's device is regularly connected to the internet to allow background GMS token rotation and policy polling.

Auditing Always Allowed App Exemptions and System Service Dependencies

Solution:

Root Cause: Inherited Exemption Profiles and Essential Service Hooks

Google Family Link maintains an 'Always Allowed' white-list category that overrides both global daily screen time limits and specific app block rules. Additionally, certain apps that rely on core system webviews (such as Google Chrome, Android System WebView, or default OEM dialers) can bypass block flags if their underlying system component is explicitly exempted under Family Link settings.

Diagnostic Verification:

Open the Family Link Parent app.

Select the child's profile > Controls > App limits.

Review the Always Allowed tab to inspect which applications are bypassed.

Step-by-Step Fix:

1Revoke Always Allowed Privileges:

In the Family Link Parent App, navigate to App limits.

Tap the target application and switch its setting from Always Allowed to Set Limit or Block.

2Restrict Underlying Web Browsers:

If the child is accessing blocked services via web shortcuts or embedded webviews, locate Google Chrome or default OEM browsers in the app list and set an explicit limit or block.

3Block Google Play Store Installation Access:

Go to Controls > Content restrictions > Google Play.

Under 'Require approval for', set it to All content to prevent the child from installing alternative browser wrappers.

Prevention & Long-Term Monitoring:

Audit the 'Always Allowed' list bi-weekly to ensure newly installed utilities or secondary browsers have not been granted structural exemptions.

Resolving Family Group Synchronization Locks and Multi-Parent Administrative Clashes

Solution:

Root Cause: Google Family Group Schema Mismatch and Conflicting Guardian Policies

If a Family Group contains two parent/guardian accounts, policy write conflicts can occur if one parent profile operates on an outdated version of the Family Link app or if a local database lock exists in the Google Account family management layer (families.google.com). This results in policy updates being rejected by Google servers during database commits.

Diagnostic Verification:

Visit Google Family Management in a web browser.

Verify if policy changes made via the web interface accurately reflect on the child's account compared to the mobile app.

Step-by-Step Fix:

1Update Family Link Apps on Parent Devices:

Open Google Play Store or Apple App Store on all guardian devices and update Google Family Link to the latest release.

2Re-Authenticate Secondary Guardian Accounts:

If two guardians exist, ensure both have accepted the Family Group invitation and hold matching administrative permissions at families.google.com.

3Apply Policy via Web Portal Fallback:

Log into families.google.com or the web-based Family Link portal, select the child's account, and apply the app block directly from the browser to bypass local mobile app state bugs.

Prevention & Long-Term Monitoring:

Maintain unified administrative settings across all secondary guardians and avoid using legacy third-party management wrappers.

Eliminating Sideloaded APKs, Samsung Secure Folder, and Secondary User Profiles

Solution:

Root Cause: Isolated Android Containers and Secondary Profile Execution

Family Link policies bind strictly to the primary supervised Google Account under the default Android user profile (User 0). Advanced users can bypass app blocks by installing applications inside isolated Android containers such as Samsung Secure Folder, Xiaomi Dual Apps, or by creating secondary Android User Profiles / Guest Accounts that do not inherit the primary user's supervision rules.

Diagnostic Verification:

On the child's device, pull down the quick settings shade and look for a User Switcher icon.

On Samsung devices, check if 'Secure Folder' is installed and active in the app drawer.

Step-by-Step Fix:

1Disable Multiple Users & Guest Profiles:

Go to Settings > System > Multiple users.

Toggle Use multiple users to OFF.

Ensure 'Add users from lock screen' is disabled.

2Remove OEM Isolated Containers (Samsung Secure Folder / Dual Messenger):

Go to Settings > Security and privacy > Secure Folder > More settings > Uninstall.

Go to Settings > Advanced features > Dual Messenger and toggle off all duplicate instances.

3Block Sideloading (Unknown Sources) & Developer Options:

In the Family Link Parent app, go to Controls > Devices > Select child's device > Device settings.

Toggle Apps from unknown sources to OFF.

Ensure Developer Options is set to Blocked to prevent USB debugging installs via ADB.

Prevention & Long-Term Monitoring:

Periodically inspect the device storage settings to detect duplicate application packages (.apk) residing in non-standard directories.

Restricting Play Store Uninstallation Bypasses and In-App App Installers

Solution:

Root Cause: App State Reset via Play Store Cache & Immediate Reinstallation

When an app reaches its daily screen time limit or gets blocked, children can uninstall the app via the Google Play Store and immediately reinstall it. Upon reinstallation, the local package manager treats the installation as a new instance, temporarily resetting time counters until the next cloud synchronization cycle completes.

Diagnostic Verification:

Open the Google Play Store on the child's device while an app limit is active.

Search for a limited app and check if the 'Uninstall' and 'Install' buttons are fully accessible without requiring a parent PIN.

Step-by-Step Fix:

1Enforce Approval for All App Downloads:

In the Family Link Parent App, navigate to Controls > Content restrictions > Google Play.

Under 'Require approval for', select All content (includes free apps, updates, and re-downloads).

2Block Access to Play Store Settings & Side-Installers:

In Family Link > App limits, locate Google Play Store.

Set a strict daily limit on the Play Store itself (e.g., 15 minutes) or block it entirely when not actively installing approved apps.

3Restrict Package Installer Permissions:

Go to child device Settings > Apps > Special app access > Install unknown apps.

Ensure every third-party app (Chrome, Drive, Files) is set to Not allowed.

Prevention & Long-Term Monitoring:

Require parent approval for all app store activities so that re-downloading blocked or limited apps is impossible without direct guardian authorization.

Locking System Date, Time Zone, and Automatic Network Time Synchronization

Solution:

Root Cause: Time-Zone Manipulation Resetting Local Countdown Timers

Family Link enforces screen time limits and scheduled downtime based on the local system clock of the child's device. By manually setting the device system time backward or altering the active Time Zone in settings, the local Family Link daemon evaluates current usage against a past timestamp, effectively neutralizing app block triggers.

Diagnostic Verification:

On the child's device, open Settings > General Management / System > Date and time.

Check if 'Automatic date and time' or 'Automatic time zone' is toggled OFF.

Step-by-Step Fix:

1Lock Date and Time Settings via Family Link:

In the Family Link Parent app, select the child's device under Devices > Settings.

Ensure Date & time management is locked so that only parents can modify clock parameters.

2Enforce Network-Provided Time (NTP):

On the child's device, navigate to Settings > System > Date and time.

Enable Use network-provided time and Use network-provided time zone.

3Block Settings App Access if Necessary:

If the child continues using third-party time manipulation apps, set an explicit limit on the Settings app or lock system settings via Family Link restrictions.

Prevention & Long-Term Monitoring:

Check the device timestamp periodically against an independent clock to verify network time synchronization is functioning properly.

Hardening Notification Shade Controls, Widgets, and Multi-Window Overlays

Solution:

Root Cause: Intent Interception via Notification Actions and Picture-in-Picture (PiP)

Certain applications (YouTube, media players, messaging apps) instantiate sub-activities or Floating Windows / Picture-in-Picture (PiP) modes that bypass the main window activity stack monitored by Family Link's overlay blocker. Children can launch app features directly via interactive notification actions without opening the main blocked activity.

Diagnostic Verification:

While an app is blocked, swipe down the notification shade on the child's device. If interactive playback controls or reply buttons remain usable, notification intent bypass is occurring.

Step-by-Step Fix:

1Disable Picture-in-Picture (PiP) Mode:

On the child's device, go to Settings > Apps > Special app access > Picture-in-picture.

Select the target app (e.g., YouTube, Chrome, Twitch) and toggle Allow picture-in-picture to OFF.

2Restrict Lock Screen and Shade Notifications:

Go to Settings > Notifications > Lock screen notifications and set to Hide content or Don't show notifications.

3Revoke 'Display Over Other Apps' Permission for Non-System Tools:

Go to Settings > Apps > Special app access > Appear on top / Display over other apps.

Ensure no third-party overlay tool or utility has permission to draw above system interfaces.

Prevention & Long-Term Monitoring:

Revoke Picture-in-Picture privileges for all entertainment and social media applications on supervised devices.

Re-Granting Revoked Usage Access and Accessibility Administrative Permissions

Solution:

Root Cause: Revoked Usage Access and Display Overlay Administrative Rights

To detect which app is currently running in the foreground and draw a block screen over it, Google Family Link relies on two core Android permissions: Usage Access (PACKAGE_USAGE_STATS) and Display Over Other Apps (SYSTEM_ALERT_WINDOW). If the child revokes these permissions manually, Family Link loses visibility into foreground package execution, allowing blocked apps to run unimpeded.

Diagnostic Verification:

On the child's device, go to Settings > Apps > Special app access > Usage access.

Inspect the status for Google Play Services and Parental controls / Family Link. If marked 'Not allowed', permissions have been revoked.

Step-by-Step Fix:

1Re-Enable Usage Access:

On the child's device, navigate to Settings > Apps > Special app access > Usage access.

Tap Google Play Services and Parental controls, then toggle Allow usage tracking to ON.

2Re-Enable Display Over Other Apps:

Go to Special app access > Display over other apps / Appear on top.

Toggle Allow display over other apps to ON for both Google Play Services and Parental controls.

3Enable Device Admin App Protections:

Go to Settings > Security > Device admin apps.

Ensure Family Link Manager is activated as a Device Administrator to prevent unauthorized permission tampering.

Prevention & Long-Term Monitoring:

Maintain Device Administrator privileges on Family Link Manager to prevent children from stripping system permissions.

Aligning ChromeOS Application Limits with Web Browser and PWA Restrictions

Solution:

Root Cause: Platform Architecture Disconnect Between Android Container and Chrome Browser

On Chromebooks (ChromeOS), Android applications run within an isolated ARC++ / ARCVM container, whereas Chrome web browser tabs and Progressive Web Apps (PWAs) run natively on the ChromeOS kernel. Blocking the Android version of an app (e.g., the TikTok Android app) does not automatically block its web equivalent (tiktok.com) inside the Chrome browser unless web restrictions are explicitly configured.

Diagnostic Verification:

On the Chromebook, attempt to access the blocked service via both the installed Android app and the Chrome browser address bar. If the website loads while the app is blocked, web filtering rules must be updated.

Step-by-Step Fix:

1Enforce Web Filtering in Family Link Parent App:

Open Family Link, select the child profile, and navigate to Controls > Content restrictions > Google Chrome.

Select Try to block explicit sites or Only allow approved sites.

2Add Explicit URL Block Rules:

Under Manage sites, tap Blocked and add the domain URLs of the services you wish to restrict (e.g., discord.com, tiktok.com, roblox.com).

3Restrict Incognito Mode and Developer Shell:

Verify that Incognito Mode is disabled (Family Link disables Incognito automatically on supervised Chromebooks).

Ensure Crostini (Linux Beta) and Developer Mode are blocked under Device Settings > Chromebook settings.

Prevention & Long-Term Monitoring:

Block both the Android package name and the corresponding domain URL to ensure full cross-platform coverage on ChromeOS.

Configuring iOS/iPadOS Limitations and Apple Screen Time Interoperability

Solution:

Root Cause: Apple Sandbox Restrictions on iOS/iPadOS Hardware

Due to Apple's strict application sandboxing policies, third-party management apps like Google Family Link cannot inspect running foreground processes or draw system-level blocking overlays on iPhones or iPads. On iOS, Family Link can only manage Google account services (YouTube, Google Search, Chrome filtering) and cannot enforce native app limits or screen time locks on third-party iOS apps.

Diagnostic Verification:

Review the Family Link Parent app while managing an iOS device. Note that native app limits, app blocking, and device downtime options are missing or grayed out for non-Google iOS applications.

Step-by-Step Fix:

1Implement Native Apple Screen Time Controls for App Blocking:

On the child's iPhone/iPad, open Settings > Screen Time.

Tap Use Screen Time Passcode and set a secret 4-digit PIN known only to the parent.

2Set Native iOS App Limits:

Go to Screen Time > App Limits > Add Limit.

Select categories or specific iOS apps and set the daily allowed duration to 1 minute (or block them via Content & Privacy Restrictions).

3Restrict App Installs and Deletions via Apple Settings:

Go to Screen Time > Content & Privacy Restrictions > iTunes & App Store Purchases.

Set Installing Apps, Deleting Apps, and In-app Purchases to Don't Allow.

Prevention & Long-Term Monitoring:

Use Apple Screen Time for native iOS hardware and app enforcement, reserving Google Family Link for supervising Google account services.

Exempting Google Play Services from OEM Battery Optimization and Killers

Solution:

Root Cause: Aggressive OEM Background Process Termination (Samsung, Xiaomi, OnePlus)

Custom Android skins (such as Samsung One UI, Xiaomi HyperOS/MIUI, OnePlus OxygenOS) enforce aggressive battery-saving algorithms that kill idle background services. If the operating system terminates com.google.android.gms.persistent or the Family Link monitoring daemon to conserve battery, real-time app tracking stops, preventing block screens from triggering when limits are reached.

Diagnostic Verification:

Check the child's device manufacturer. Devices from Xiaomi, Samsung, and Huawei frequently terminate background monitoring daemons.

Check dontkillmyapp.com for OEM-specific background throttling behavior.

Step-by-Step Fix:

1Disable Battery Optimization for Google Play Services:

On the child's device, go to Settings > Apps > Google Play Services > Battery.

Change setting from 'Optimized' / 'Restricted' to Unrestricted.

2Disable Battery Optimization for Parental Controls App:

Go to Settings > Apps > Parental controls (or Family Link).

Set Battery usage to Unrestricted.

3Exclude from OEM Power Management (Samsung Example):

Go to Settings > Battery and device care > Battery > Background usage limits.

Ensure Family Link and Google Play Services are added to Never sleeping apps and absent from 'Deep sleeping apps'.

Prevention & Long-Term Monitoring:

Set battery management for all core Google management services to 'Unrestricted' on custom OEM Android builds.

Restoring Persistent Socket Connections, VPN Bypasses, and DNS Filters

Solution:

Root Cause: Network Socket Blockade, Active VPN Bypasses, or Custom Private DNS

Google Family Link relies on an uninterrupted TCP connection to Google push notification servers (mtalk.google.com:5228-5230). If the child installs a third-party VPN, configures a custom Private DNS (e.g., AdGuard, Cloudflare), or uses local firewall apps (NetGuard), the background socket connection is severed, preventing remote policy enforcement commands from reaching the device.

Diagnostic Verification:

On the child's device, check the status bar for a key or shield icon indicating an active VPN connection.

Check Settings > Network & internet > Private DNS.

Step-by-Step Fix:

1Remove Unauthorized VPN Profiles:

On the child's device, navigate to Settings > Network & internet > VPN.

Tap the settings gear next to any third-party VPN and select Forget VPN.

2Lock Private DNS Settings:

Go to Settings > Network & internet > Private DNS and set it to Automatic or Off.

3Restrict Network Configuration Changes in Family Link:

In the Family Link Parent app, go to Controls > Devices > Select child's device.

Ensure Network settings modification is locked so that children cannot add new VPN configurations or alternative DNS servers.

Prevention & Long-Term Monitoring:

Inspect network settings periodically to ensure no unauthorized tunneling applications or custom DNS servers are active on supervised devices.

Related Diagnostic Guides

System Interrupts High CPU Usage 100% Fix Tree

NVMe SSD Not Showing Full Speed In CrystalDiskMark: PCIe Lane Diagnostic

Windows 11 File Explorer Slow To Load Green Bar Fix

Mechanical Keyboard Some Keys Double Typing: Debounce Diagnostic

AirPods Connected to Windows But Sound Is Low Quality: Hands-Free Profile Fix

Subscribe to StepDiag

Embed Guide on Your Website