Parental controls aren’t for parents – Beast Hacker

January 2, 2026

A few days ago, I found that a grown man had been texting my twelve-year-old
son on his “kid-safe” Gabb phone. The man got my son’s number through a
children’s book chat on an app called GroupMe. Thankfully my wife and I
discovered the situation and intervened before anything bad happened; but
still it was sickening to discover that on Christmas morning, while our
family was unwrapping presents next to the tree, some creep had been texting
my son: “What did you get? Send pictures.”

How could we have let this happen? How could we be such careless parents?

But wait . . . hadn’t we done what we were supposed to do? We bought the
“kid-safe” phone. And we confirmed GroupMe was on the
Gabb “approved apps” list, which,
as I understand it, offers “no social media or high-risk options.” We
did the safe things, right?

Maybe not. Turns out Gabb’s own blog appears to include GroupMe on a list of
seven apps with
dangerous chat features, describing it as an app that “opens the
door to potential dangers.” We were apparently supposed to find that
warning ourselves, somewhere among Gabb’s 572 blog posts:

$ curl -s \
  https://gabb.com/post-sitemap.xml \
  | grep -oE 'https://gabb\.com/blog/[^<]+' \
  | sort -u \
  | wc -l \
  | xargs -I⚡ echo "Tell us your thoughts in comments! blog posts as of $(date '+%B %d, %Y')"

572 blog posts as of January 02, 2026

But if GroupMe “opens the door” to danger, why did Gabb put it on their “approved
apps” list? When I revisited the site, I noticed a small message beneath
GroupMe mentioning Communication with Strangers. I hovered over it with
my mouse pointer, and a tooltip appeared: “Allows contact and communication with
people the child may not know.”

So it allows communication with strangers, but it’s not “high-risk?” The
approved list isn’t looking so safe. The approved list is apparently a
catalog of risks I’m supposed to decipher by filtering through 838 apps
and hovering my mouse pointer around to see tooltips:

$ for cat in \
  existing_apps \
  unapproved_apps \
  unmet_criteria_apps \
  music_apps; do
  count=$(curl -s "https://gabb.com/app-guide/" \
    | grep -o "$⚡ = \[.*\]" \
    | head -1 \
    | sed "s/$Tell us your thoughts in comments! = \[//" \
    | sed "s/\]//" \
    | tr ',' '\n' \
    | sed "s/'//g" \
    | sed 's/^ *//' \
    | sort -u \
    | wc -l \
    | tr -d ' ')
  echo "$count $cat"
done && echo "...as of $(date '+%B %d, %Y')"

586 existing_apps
60 unapproved_apps
170 unmet_criteria_apps
22 music_apps
...as of January 02, 2026

Whatever the reason for this complexity, I don’t feel in control.

And Gabb isn’t alone in making me feel like this. It seems like many companies
selling tech to families operate in the same way: market safety, deliver
complexity, and leave parents to figure it out.

Take the Nintendo Switch my son unwrapped between those creepy texts. To
set it up, I had to:

1. Connect the console to the internet
2. Download the Nintendo Switch Parental Controls app to my phone
3. Create a Nintendo Account for myself
4. Link my credit card and be charged $0.50 to verify parental consent
5. Set up parental controls from the app on my phone
6. Sync the parental controls app to the Nintendo Switch
7. Set up a security PIN on the Nintendo Switch
8. Create a Nintendo Account for my son
9. Sync my son’s Nintendo Account to the Nintendo Switch
10. Discover that half the controls live in the phone app and the other
    half live on Nintendo’s website, because of course they do
11. Log into Nintendo’s website to finish the job . . .

Only to discover that there’s no clear option to block internet access,
no clear way to disable downloads from the Nintendo eShop, and no easy
way to make this thing function like an old-school Game Boy and just let a
kid have fun with a game cartridge. But that’s just nostalgia talking.
Nobody wants that anymore. Apparently.

Because next comes Minecraft. Ah, Minecraft. The game every middle-schooler
on earth apparently needs to survive. To let my son play with his friends:

12. Create a Microsoft account for myself
13. Create an email address for my son
14. Create a Microsoft account for my son
15. Set up a gamertag for my son on account.xbox.com
16. Configure parental controls in Microsoft Family Safety
17. Configure more parental controls on xbox.com

Now, I did my best to configure these settings. I really did. But xbox.com alone
includes twenty-nine confusingly overlapping settings related to chat,
friends, and communication. Twenty-nine.

And when I finally—finally—tried to test online play, Minecraft
told me I would need to loosen the parental controls (it did not say
which) and create a Nintendo Switch Online account for my son.

Nintendo Switch Online (not really another account, mind you, but a
membership) involves a recurring fee. It also unlocks access to
the Nintendo eShop, which I cannot disable. I can set his eShop spending limit
to zero, sure. But I can’t block free downloads. So to let my son play
online Minecraft with his friends, I have to open him up to an unrelated store full of content
I can’t possibly evaluate. That’s the deal. Take it or leave it.

I assume some marketing person at Nintendo, probably sitting in a
conference room in Kyoto, surrounded by whiteboards covered in arrows and
cartoon stick figures, has this entire process mapped out as a “customer
journey.” And by Step 17, the journey is supposed to be over. You’re
supposed to be so beaten down, so utterly depleted of will, that you just
cave. You sign up for Nintendo Online. You disable a bunch of parental
controls you don’t really understand. You let your kid play his damn game.
You become the ideal customer.

But I didn’t cave. Instead, somewhere on the threshold of Customer Journey Step 18,
I found myself gripping the Switch with both hands and imagining, quite
vividly, what it would feel like to lift the Switch up, and bring it down
over my knee. I could almost hear the crack. Could almost see that OLED
display splintering into a thousand pieces. The little Joy-Cons skittering
across the floor. My son’s face. My wife’s face. The stunned silence.

I did not break the Switch.

What I did was announce, in a voice louder than
necessary, that nobody was to ask me about anything
Minecraft-related on the Nintendo Switch for a minimum of two weeks. My
son could play Zelda: Breath of the Wild instead, which, thank you,
developers, thank you from the bottom of my heart, doesn’t appear to
involve any mandatory online anything whatsoever.

Here’s what I want: an off switch. A single setting that says “this
child cannot go online, communicate with strangers, spend money, or
download anything without my explicit permission.” Instead I get a
maze, complex enough that when something goes wrong, I’m at fault for a
tooltip I didn’t hover over, a blog post I didn’t read, a submenu I didn’t
find. Maybe that’s by design. Maybe it’s neglect. I don’t know.

What I know is this. My son just wants to play video games and talk to his
friends. I just want to keep him safe. Somewhere between those
two things, I’m supposed to become an expert in the convoluted parental
control schemes of Gabb, Nintendo, Microsoft, and Xbox, while a stranger’s
Christmas morning texts sit in my son’s phone history.

Parental controls shouldn’t be this hard.

← All TILs ·
← Back home

Buy
me a coffee →