Chromebook Parental Controls — Personal vs. School-Managed (The Distinction That Matters)

Chromebooks have two completely different parental-control answers depending on who owns the device. Personal Chromebooks work with Family Link plus three Chromebook-specific locks. School-managed Chromebooks CAN'T use Family Link — the school's Workspace for Education admin takes priority — so your control surface moves to home-network DNS filtering, physical-use rules, and coordinating with school IT. School devices are the #1 bypass vector (35.5%); this guide covers both scenarios.

Why Chromebooks need their own guide

Most parents assume a Chromebook is "just an Android-ish laptop" and that Google Family Link covers it the way it covers an Android phone. It half does — and the half it doesn't is the half that matters.

There are two completely different Chromebook situations, and which one you have determines what you can control:

Personal / family-owned Chromebook — you bought it. You're the owner. Family Link works, more or less like it does on an Android phone (with some Chromebook-specific wrinkles).
School-issued / school-managed Chromebook — the school owns it and enrolled it in their Google Workspace for Education admin console. You cannot install Family Link controls on it. The school's IT department's rules take priority over anything you try to set. This is the scenario most parents are actually in, and it's the #1 way kids bypass parental controls — school devices account for 35.5% of all documented bypass cases.

This guide covers both, but spends most of its time on the school-managed scenario, because that's the genuine gap and the genuine parent pain point. The personal-Chromebook account-level controls overlap heavily with our Google Family Link guide — we'll cross-link rather than repeat.

The one distinction to understand first

Google ties parental control on a Chromebook to the account signed in and how the device is managed, not to the hardware. Three combinations exist:

Device management	Account	Family Link applies?
Personal (you own it)	Child's supervised Google account	✅ Yes
Personal (you own it)	School account added as a secondary account to the supervised profile	✅ Yes — controls still apply, child can use Classroom
Personal (you own it)	School account added as a separate new user on the sign-in screen	❌ No — Family Link does not apply to that user
School-managed (Workspace for Education)	Any account	❌ No Family Link — the school's admin console controls the device

Two traps live in this table:

The "separate new user" trap: on your personal Chromebook, if your kid adds their school account as a new user (not as a secondary account inside their supervised profile), they get an unsupervised session. The fix: add the school account inside the supervised profile, and lock down who can add new users (see below).
The school-managed reality: if the device itself is school-enrolled, none of your Family Link setup applies to it, period. Your control surface moves entirely to the network layer and the conversation.

Scenario A — Personal / family-owned Chromebook

If you bought the Chromebook, you're the owner, and you control it.

Setup (the Chromebook-specific parts)

The account-level controls (app approval, SafeSearch, Chrome web filter, screen time, bedtime) are identical to the Android setup — see our Google Family Link guide for the full walkthrough of those. Here are the Chromebook-specific steps that guide doesn't cover:

1. Make sure YOU are the Chromebook's owner account. The first Google account signed into a fresh Chromebook becomes the "owner" with device-level control. Set the Chromebook up with YOUR account first, then add your child as a supervised user. If your child set it up themselves, they're the owner — you may need to Powerwash (factory reset) and re-set-up with your account as owner.

2. Add your child as a supervised user. Sign in with their Family-Link-supervised Google account. Family Link controls flow to the Chromebook automatically once they sign in.

3. Disable Guest mode. This is the most-important Chromebook-specific lockdown. Guest mode lets anyone use the Chromebook with no account and no Family Link controls.

As the owner account: Settings → Security and sign-in → Manage other people (path varies slightly by ChromeOS version) → toggle Enable Guest browsing OFF.

4. Restrict who can sign in. Same Manage-other-people screen → toggle Restrict sign-in to the following users ON → add only the accounts you approve. This prevents your kid from adding a new (unsupervised) user — including the "school account as separate user" trap.

5. Add the school account the RIGHT way (if needed). If your kid needs their school Google account for Classroom on this personal Chromebook, add it as a secondary account inside their supervised profile, not as a new user:

In the child's supervised session → Settings → Accounts → Add account → sign in with the school account.
This keeps Family Link controls applying while letting them reach Classroom.

Chromebook-specific bypass surfaces (personal device)

Guest mode — disabled in step 3.
New-user sign-in — restricted in step 4.
Developer mode — a boot-time toggle that can disable some managed restrictions. On a Family-Link-supervised personal device, the controls largely survive developer mode, but it's worth knowing the toggle exists (Esc + Refresh + Power at boot). If you're concerned, the restricted-sign-in lock is your main defense.
Chrome extensions — kids can install browser extensions, including VPN extensions that bypass your home DNS filter. Family Link's app-install controls don't always catch extensions. See our VPN apps guide for the extension-VPN problem.
Powerwash (factory reset) — wipes the Chromebook. On a supervised personal device, re-setup re-applies controls, but a kid could re-set-up as the owner if they reach the reset before you. Owner-account control is your defense.

Scenario B — School-managed Chromebook (the real gap)

This is where most parents actually are, and where the playbook is completely different.

Why you can't just install Family Link on it

A school-issued Chromebook is enrolled in the school's Google Workspace for Education admin console. That enrollment is device-level and takes priority over everything. The practical consequences:

You cannot add Family Link supervision to the device. Google explicitly blocks it — a Workspace-for-Education-managed Chromebook can't be managed by Family Link.
The school's IT admin decides which Google services, extensions, and sites are allowed — during school hours AND after, unless the school has a time-based policy.
You can't change the device's core settings. Many are locked by the admin console.

This isn't a workaround you're missing. It's a structural fact of how managed ChromeOS works. Accept it and move your control surface elsewhere.

What you CAN do with a school Chromebook

Four levers, none of which involve installing software on the device:

1. Find out the school's actual policy. (Do this first.) Most parents never ask. Email the school's IT contact (or check the parent handbook) and get answers to:

Is the device filtered 24/7, or only during school hours? (Many schools filter only on the school network — meaning the device is wide open on your home Wi-Fi.)
What's blocked? (Adult content? Social media? Games? Or just a thin filter?)
Can I get a parent view of activity? (Some schools use GoGuardian / Securly / Lightspeed, which offer parent portals — ask if yours does and how to enroll.)
Is there an after-hours / weekend policy I should know about?

The answer reshapes everything else. A school that filters 24/7 with GoGuardian-parent-access needs very little from you. A school that filters only on-campus means the device is unmanaged the moment it's on your home Wi-Fi.

2. Apply home-network DNS filtering. Since you can't install software on the device, the network it connects to becomes your control surface. When the school Chromebook is on your home Wi-Fi, your router's DNS filter applies to it like any other device. Block adult-content categories at the router via NextDNS, OpenDNS for Families, or your router's built-in filter.

Cross-link: DNS at your router and NextDNS for Families.
Force-all-DNS at the router (redirect all port-53 traffic through your filter) so the kid can't change the Chromebook's DNS to bypass it. Covered in our UniFi guide for UniFi; search "force DNS" for other routers.

3. Control the physical-use rules. You own the home, even if you don't own the device. The highest-leverage non-technical controls:

"School Chromebook stays in a common area after dinner" — no bedroom use
"School Chromebook charges overnight in the kitchen" — removes the late-night unsupervised window
"School Chromebook is for schoolwork; the family device is for everything else" — sets the expectation

4. Block hotspot bypass. A kid can route a school Chromebook around your home Wi-Fi filter by connecting it to their phone's hotspot. Block hotspot/tethering on the kid's phone (Apple Screen Time → Cellular Data Changes → Don't Allow; Family Link → restrict tethering) so the school device can't escape your network filter onto cellular.

What you CAN'T control on a school Chromebook

Be honest about the fence:

On-device settings locked by the school admin — you can't change them.
What the school's filter does or doesn't block on the school network — that's their policy.
Guest mode / developer mode — usually locked by the school's enrollment (a rare upside of school management), but verify with IT.
The device when it's on a friend's Wi-Fi or cellular hotspot — your home DNS filter doesn't reach it there.
What the kid does in the gap between "school filter (on-campus)" and "your filter (home Wi-Fi)" — e.g., on the bus, at a coffee shop, on open public Wi-Fi.

Chromebook-specific bypass surfaces (both scenarios)

Ranked by frequency:

1. Guest mode — no account, no controls. Disable on personal devices (Scenario A step 3); usually locked by the school on managed devices.

2. Adding a separate user — the "school account as new user" trap on personal devices, or any unsupervised Google account added as a new user. Restrict sign-in (Scenario A step 4).

3. Chrome extension VPNs — a VPN extension installed in Chrome bypasses your home DNS filter. Family Link's app controls don't reliably catch extensions. The force-all-DNS router config (Scenario B lever 2) is the structural defense. Cross-link: VPN apps guide.

4. Cellular hotspot — routes around home Wi-Fi. Block tethering on the kid's phone (Scenario B lever 4).

5. Developer mode / Powerwash — boot-time resets. Usually blocked on managed (school) devices; on personal devices, owner-account control + restricted sign-in is the defense.

6. Different browser — Family Link's web filter applies to Chrome. A kid who installs a different browser (where ChromeOS allows it) escapes the filter. DNS-level filtering catches this regardless of browser.

Operational rhythm

At setup (personal Chromebook): disable guest mode, restrict sign-in, confirm you're the owner account. These three Chromebook-specific locks are the highest-leverage one-time moves.
At the start of each school year (school Chromebook): email the school IT contact and get the four policy answers (lever 1). Policies change yearly; so do the devices.
Monthly (both): confirm your home DNS filter is active and the school device routes through it on home Wi-Fi. On personal devices, check Manage-other-people for any new users you didn't add.
Ongoing: the physical-use rules do most of the work for school devices. Reinforce the "common area after dinner" routine.

What to actually talk to your kid about

The technical levers are a backstop. For school devices especially, the conversation carries more weight than usual — because your technical control is genuinely limited.

Prompts worth using:

"What do you and your friends actually use the school Chromebook for besides schoolwork?" Open question. Most kids will volunteer the games / YouTube / messaging use. That's the conversation, not a gotcha.
"Does the school's filter block stuff, or can you get to whatever you want on it?" Kids know exactly how porous their school's filter is. Their answer tells you more than the school's IT will.
"Has anyone shown you a trick to get around the school filter?" Filter-bypass tricks spread fast in school hallways (proxy sites, specific VPN extensions, the "translate this page" trick). Asking surfaces what's circulating.
"If the school device buzzes at night, what's that about?" Opens the late-night-use conversation without an accusation.

What NOT to lead with:

"I'm going to lock down your school Chromebook completely." You largely can't — and saying so when you can't erodes credibility. Be honest that the school device is a shared-control situation.
"School Chromebooks are dangerous." They're a tool the kid needs for school. The frame is "let's be smart about the after-school gap," not "this device is bad."

Bottom line

The Chromebook question has two completely different answers depending on who owns the device:

Personal Chromebook: Family Link works (see the Google Family Link guide for account controls), plus three Chromebook-specific locks — disable guest mode, restrict sign-in, confirm owner account.

School-managed Chromebook: you can't install Family Link, so your control surface is (1) knowing the school's actual policy, (2) home-network DNS filtering, (3) physical-use rules, (4) blocking hotspot bypass. The school's admin console takes priority on the device itself — accept that and layer around it.

If you do nothing else after reading this guide, do these three things tonight:

Figure out which Chromebook you have — personal (you can use Family Link) or school-managed (you can't). It changes everything.
Personal: disable Guest mode + restrict sign-in. School: email the school IT contact for their filtering policy (24/7 or school-hours-only?).
Both: confirm your home network has DNS filtering active, so the Chromebook is filtered when it's on your Wi-Fi — the one control surface that works regardless of who manages the device.

The rest can wait until next weekend (or the start of the school year).

Sources

The school-device-as-#1-bypass-vector statistic (35.5%) is from the bypass research that anchors our bypass-prevention checklist — school Chromebooks are Category 1 there. For the account-level controls (app approval, SafeSearch, Chrome filter, screen time, bedtime) that apply to personal Chromebooks, see Google Family Link. For the home-network layer that's your main lever on school devices, see NextDNS for Families, DNS at your router, and UniFi Parental Controls. For Chrome extension VPNs, see VPN apps on kids' devices.

No affiliate relationship with Google or any tool named in this guide.