A tablet handed to a seven-year-old is a camera, a microphone, a location beacon and a payment terminal, and the defaults on every one of those are set for the company selling it, not for your family. The settings below take about forty minutes and cover the four things that cause trouble: a shared login, an advertising ID, in-app purchases, and app permissions nobody opens.
Make a child account instead of sharing yours
If the tablet runs on your own Google or Apple account, every search, app and ad identifier is recorded as yours, and you cannot revoke any of it without changing your own password. Create the child profile properly instead.
- Android (Samsung, Lenovo, Xiaomi): install Google Family Link on your phone, then add a child under 13 as a supervised Google Account. The child signs in on the tablet with that account, not yours.
- Amazon Fire tablets: Settings > Profiles & Family Library > Add Child Profile, then set up Amazon Kids. The child profile is a separate space; your Amazon account stays behind a PIN.
- iPad: Settings > Family > Add Member > Create a Child Account, then enable Screen Time for that Apple ID.
On a Fire HD 10 Kids the child profile is the default out of the box; the leak starts when someone switches to the parent profile for Netflix and forgets to switch back. Put a PIN on it and change that PIN quarterly.
Kill the advertising ID
The advertising ID is the single setting that turns a free drawing app into a data pipe. On Android 12 and later, go to Settings > Google > Ads > Delete advertising ID, which replaces it with zeros; apps keep working, they just cannot build a profile. On a Fire tablet it is Settings > Security & Privacy > Advertising ID > Off. On an iPad, open Settings > Privacy & Security > Apple Advertising and switch off Personalised Ads, then check Tracking and turn off “Allow Apps to Request to Track” so no app can even ask.
Do this before installing anything: settings applied afterwards do not erase the profile the app has already sent.
Stop purchases at the source
A $2.99 coin pack is the classic first leak, rarely the child’s fault — one tap on a screen that asked for a password a single time and then remembered it. Close it in three places:
- Google Play: Play Store > profile icon > Settings > Family > Parental controls, then set authentication to “For all purchases and in-app purchases through Google Play on this device”.
- Amazon Kids: open the Parent Dashboard > Settings > turn off In-App Purchases. Amazon Kids+ content itself has no ads, but third-party apps inside the profile can still sell things.
- iPad: Screen Time > Content & Privacy Restrictions > iTunes & App Store Purchases > In-app Purchases > Don’t Allow, plus Ask to Buy on the child’s Apple ID so every install needs your approval.
Apple’s own walkthrough covers the iPad side in more detail, including Ask to Buy when you are away from your phone: support.apple.com — set up parental controls on a child’s iPhone or iPad.
Audit the permissions by hand
This is the part no parental control dashboard summarises for you. On Android 12 and up, Settings > Privacy > Permission manager groups apps by permission and shows which used the microphone or camera in the last 24 hours. On iPad it is Settings > Privacy & Security and then the individual permission. Work through four:
Microphone — voice chat in Roblox, Minecraft and a handful of messaging apps is legitimate; a colouring app asking for it is not. Location — set games to “While using” and never “Allow all the time”; there is no game that needs your home address in the background. Camera — needed by school apps and QR scanners, not by puzzle games. Photos — on Android 13+ choose “Select photos” rather than “Allow all”, so the app sees the three pictures it needs and nothing else.
Treat it as a 15-minute sweep; the method matches a full Android permissions audit, applied to a shorter app list.
Browsers and video are the last open door
A tablet’s browser is where parental controls usually fail, because the app store rating system says nothing about what a website serves. On Fire tablets the Amazon Kids browser is limited to an allowlist you approve in the Parent Dashboard — leave it on. On iPad, Screen Time > Content & Privacy Restrictions > Content Restrictions > Web Content offers “Limit Adult Websites” or, for children under nine, “Allowed Websites Only” with a hand-typed list. YouTube Kids is a separate app with its own settings: in the parent profile, open Settings > your child’s profile and turn on “Approved content only”, which disables search entirely and means you choose every channel.
Finally, expect drift. Apps request new permissions in updates and children learn the parent PIN by watching. Once a month, open Family Link or the Parent Dashboard, read the activity list, remove anything from the last 30 days you did not approve, and change the PIN. Pair that with a real limit on hours rather than an argument — habits that reduce screen time work better when the device enforces them than when a parent does. If the tablet leaves the house, configure Android theft protection on the adult phone that supervises the child profile.