Google SafeSearch and Chrome Parental Controls — The Complete Parent Setup Guide

Set up Google SafeSearch and Chrome's parental controls on any device — the three ways to enforce SafeSearch, Chrome's website filter under Family Link, the AI Overviews gap parents need to know in 2026, and what the controls honestly don't cover.

What changed in 2026 — and why this guide exists

Google Search used to be a fairly straightforward thing to filter. Set SafeSearch to Filter, lock it via Family Link, and most accidental explicit content discovery through search was blocked.

Two things changed that picture in 2025–2026:

First: AI Overviews and AI Mode. In May 2026, Google made AI-generated answers a default layer on every Google Search. AI Mode — a full conversational AI experience — followed. SafeSearch applies to traditional search results. It does not govern what the AI generates. In July 2026, Common Sense Media's Youth AI Safety Institute tested Google Search's AI features and rated them an "Unacceptable Risk" for minors, finding that even with SafeSearch active, AI Overviews missed 29% of explicit references to self-harm in testing from May to July. This is a real gap, and there is currently no Family Link toggle to disable AI Overviews while leaving Search accessible.

Second: Teens now need parental approval to opt out of Family Link. For years, a child supervised by Family Link could choose to remove supervision the moment they turned 13 — unilaterally, no parental consent required. Google reversed this. Under current policy, a teen who wants to stop being supervised must get parental approval. SafeSearch and Chrome filtering continue to apply for supervised teen accounts.

This guide covers what SafeSearch actually filters, three ways to enforce it, Chrome's website filter, and — critically — what the controls miss in 2026 so you're not operating on a false sense of coverage.

This guide does not replace the Google Family Link guide, which covers Android device supervision end to end. It fills the specific gap that guide leaves: the browser layer for any device where Chrome is used, and the network-level approach for households where Family Link isn't set up.

What Google SafeSearch actually does

SafeSearch is a filter that runs on Google Search itself — web search results, Google Images, and Google Videos. It does not block websites you navigate to directly; it only filters what appears in search results.

SafeSearch has three settings:

Setting	What it does	Who gets it by default
Filter	Blocks explicit results entirely — no explicit images, videos, or primarily-explicit web pages appear	Children under 13 on Family Link; all detected under-18 accounts
Blur	Allows explicit results but blurs explicit images. Explicit text and links can still appear.	All adult accounts worldwide (Google made this the default in August 2023)
Off	No filtering	Users who manually disable it

"Filter" is what parents want. "Blur" — the adult default since 2023 — still allows explicit text and linked pages through. If your child has a Google account and nothing is configured, they may be on Blur or Off.

What SafeSearch covers

Sexually explicit imagery and video in Google Image and Video search results
Web pages whose primary content is explicit sexual material
Graphic violence in image results when set to Filter

What SafeSearch does not cover

YouTube — YouTube has its own separate filter. See YouTube Kids and Supervised Accounts setup guide.
Websites navigated to directly — a child who types a URL or follows a link bypasses search entirely
Other search engines — Bing, DuckDuckGo, Brave Search, and others have their own SafeSearch settings, not controlled by Google's
Google AI Overviews and AI Mode — the AI layer that now runs above search results is not governed by SafeSearch (see below)
Social media platforms accessed through links
Google Discover or Google News

SafeSearch makes an enormous difference for accidental explicit content discovery through search. It is not a complete solution on its own.

The 2026 gap: AI Overviews and AI Mode

This deserves its own section because most parents don't know about it yet.

When a child searches on Google today, they typically see an AI Overview — a generated summary above the traditional links. In AI Mode, the entire experience is conversational, like chatting with an AI. These features are active by default.

SafeSearch governs traditional search results. It does not govern what the AI generates in response to a query. The AI can engage with sensitive topics even when SafeSearch would prevent the underlying explicit pages from appearing in results.

There is no Family Link toggle for AI Overviews or AI Mode. The only way to prevent a child's access to the AI layer while keeping Google Search accessible is:

Block Google Search entirely in Family Link's Chrome filter (which also removes access to regular search)
Rely on Google's general AI safety guidelines, which are less restrictive than SafeSearch

For comparison: Google Gemini (the standalone AI product) can be blocked for under-13 accounts and requires parental consent — Family Link handles it. Google Search's AI does not have equivalent controls.

What this means practically: SafeSearch remains worth enabling. It blocks the traditional explicit search results that represent the most common accidental exposure. But parents should know that the AI layer is a separate surface that SafeSearch does not cover, and behave accordingly in the conversation with their child about what Google is now.

Three ways to enforce SafeSearch

There are three distinct approaches, and they are not interchangeable. Which one you need depends on your situation.

Option 1: Family Link (account-level lock)

If your child has a Google account managed through Family Link, SafeSearch is already locked to Filter by default and cannot be changed by the child. This is the most straightforward approach and the one most families will use.

To confirm or configure it:

Open the Family Link app on your phone
Tap your child's name
Tap Controls
Tap Google Search
Confirm "Filter" is selected

You can change it to Blur or Off if you have a specific reason to, but "Filter" is the right setting for children.

What changed in 2025–2026:

Google redesigned the Family Link app in February 2025. There are now dedicated Screen Time and Controls tabs rather than a single-scroll layout. The Controls tab is where you'll find both Google Search (SafeSearch) and Google Chrome settings.
Google added Approved Contacts (February 2025) — you can now limit who a child can call or text to a parent-approved list; children can request to add contacts.
As noted above, teens 13–17 now need parental approval to remove supervision.

How long it works: Family Link's effectiveness depends on the child being signed into Chrome with their supervised account. On Android phones and Chromebooks, this is well-enforced — the child's supervised account is the primary account, incognito mode is automatically disabled, and there's no easy way to use an unsupervised session. On a shared Windows or Mac computer, it's weaker — the child can sign out of Chrome or use a different browser.

Who this is for: Households with under-13 children, or teens 13–17 who are supervised via Family Link. If you're setting up Family Link for the first time, the Google Family Link guide covers account creation and device setup in full.

Option 2: Network-level enforcement via DNS

This approach enforces SafeSearch at your router — for every device on your home network, regardless of which Google account is signed in, which browser is used, or whether Family Link is installed.

It works by routing Google search requests through Google's official SafeSearch enforcement address: forcesafesearch.google.com (currently resolving to IP 216.239.38.120). When any device on your network searches Google, the router points the request to that address, which forces Filter mode regardless of account settings. This cannot be overridden from the browser or by signing out of Chrome.

The limitation: this only applies on your home network. On cellular data, or on any other network, the phone uses that network's DNS and the enforcement doesn't follow.

Does your router support this?

Not all consumer routers make this easy:

Google Nest WiFi and Google WiFi routers include a built-in "Family Wi-Fi" feature in the Google Home app. It uses SafeSearch technology to block millions of explicitly sexual websites at the router level. Setup: Google Home app → Wi-Fi → select your router → Family settings → enable SafeSearch. This is the lowest-friction option for households that already have Google networking hardware.
eero, Gryphon, Firewalla, and dedicated family routers typically include SafeSearch enforcement in their parental controls — often labeled "force search filtering" or similar.
Most basic ISP-provided gateway routers (typical Xfinity, AT&T, or similar) do not support custom DNS CNAME records without significant technical work.
Advanced routers (Unifi, pfSense, MikroTik) support local DNS overrides for users comfortable with network administration.

The general DNS configuration: create an A record pointing www.google.com → 216.239.38.120, and the same for google.com. For households where regional Google domains (google.co.uk, google.ca, etc.) are used, those should also be covered — a wildcard DNS entry is cleaner.

An easier alternative: NextDNS for Families ($2/month) enforces SafeSearch on Google, Bing, DuckDuckGo, and Yandex simultaneously with a simple toggle. It also closes the DNS-over-HTTPS bypass gap that pure router DNS configuration leaves open (Chrome and Firefox can use encrypted DNS that bypasses router DNS settings; NextDNS's browser extension handles this). For most families who want thorough coverage without advanced router configuration, NextDNS is the most practical option.

Who this is for: Households who want coverage that applies regardless of which browser a child uses, which Google account they're signed into, or whether Family Link is installed. It complements — rather than replaces — Family Link for supervised accounts.

Option 3: Google Workspace for Education (school-managed devices and accounts)

If your child's school uses Google Workspace for Education, the school's IT administrator can enforce SafeSearch for all student accounts and managed Chromebooks. This is an administrator-level setting; parents cannot configure it directly.

What you can do: contact the school's technology coordinator and ask whether SafeSearch enforcement is configured for student accounts. Many schools enable it; some do not. Google updated the admin controls available to schools in January 2025, expanding options for managing Chrome, Search, and content access for students under 18.

For school-managed Chromebooks specifically — which have a completely different control model than personal Chromebooks — the Chromebook parental controls guide covers what parents can and cannot do when the school owns the device.

Chrome's website filter under Family Link

SafeSearch controls what appears in Google Search results. Chrome's website filter controls what websites your child can visit in the Chrome browser when signed into their supervised account. These are two separate settings, and both matter.

Setup

Open the Family Link app
Tap your child's name
Tap Controls
Tap Google Chrome and Web

You'll see three postures:

Setting	What it does
Allow all sites	Child can visit any website except those you manually block
Try to block explicit sites	Chrome attempts to automatically hide most sexually explicit and violent sites. You can still manually allow or block specific sites. Recommended baseline for most families.
Only allow approved sites	Child can visit only sites you have specifically added to an approved list. Appropriate for younger children; requires your action for every new site.

Manually allow or block specific sites

Below the three main settings, tap Manage sites. There are two tabs:

Approved sites — sites your child can always visit, even if "Try to block explicit sites" would otherwise restrict them. Enter the domain (e.g., khanacademy.org) and the filter allows all pages on that domain.
Blocked sites — sites your child can never visit, regardless of the main filter setting.

When a child tries to visit a blocked site in Chrome, they see a message that the site is restricted. They can send you a request to review it — you'll receive a notification in the Family Link app. You approve or deny the specific site. Approved sites stay approved; denied sites stay blocked.

What Chrome's website filter covers — and what it misses

It works when:

Your child is signed into Chrome with their supervised Google account
They're using Chrome on Android, a Chromebook, or Chrome on desktop (signed in)
Incognito mode is blocked — on supervised Android accounts and Chromebooks, Chrome hides the incognito option entirely

It does not work when:

Your child uses a different browser — Firefox, Safari, Brave, Edge, or any browser that isn't Chrome
Your child is on a Windows or Mac computer where they can sign out of Chrome and use an unsupervised session
Your child is on a device you don't control — a friend's computer, a school device where the school hasn't configured similar controls, a library computer

The browser limitation is real. Chrome's filter only applies to Chrome. If a child opens Firefox on a Windows computer, they get an unfiltered browser. The fixes:

On Android: Family Link's app approval controls prevent installation of unauthorized browsers from the Play Store
On Windows or Mac: remove other browsers or configure Windows 11 parental controls or macOS Screen Time to block non-Chrome browser installs
At the network level: DNS-based filtering (Option 2 above) applies regardless of which browser is used, covering the gap

Safe Browsing vs. SafeSearch: they're different things

These two features are often confused because the names are similar. They do completely different jobs.

Google Safe Browsing (in Chrome settings: Privacy and Security → Security) is a security feature that protects against malicious websites, phishing attempts, malware downloads, and dangerous extensions. It has three levels:

Level	What it does
Enhanced Protection	Real-time URL checks with Google's servers; fastest response to new threats; AI-based detection
Standard Protection	Checks URLs against a locally cached list of known dangerous sites
No Protection	Not recommended

Safe Browsing is about security — keeping your child away from malware and phishing sites. A website can be completely safe from a security standpoint while hosting content that's completely inappropriate for a 12-year-old. Safe Browsing will not block it.

SafeSearch (Google Search settings, managed via Family Link) is a content filter for explicit material in search results. This is the one relevant to parenting.

The bottom line: Turn on Enhanced Protection in Chrome's Security settings for every family member's device — it's a security step everyone should have, not just parents of children. Separately, set SafeSearch to Filter in Family Link for supervised accounts. The two settings solve different problems and don't overlap.

Bypass attempts and honest limits

Children who look for workarounds will find some. Knowing where the controls break down helps you decide what else to layer on.

Switch to a different search engine. Bing, DuckDuckGo, and Brave Search each have their own SafeSearch settings — Google's enforcement doesn't apply to them. The coverage options:

Family Link's Chrome filter ("Try to block explicit sites") provides some cross-search-engine coverage, but it's not equivalent to locking SafeSearch on each engine individually
NextDNS enforces SafeSearch on Google, Bing, DuckDuckGo, and Yandex simultaneously — the most complete option

Use cellular data. DNS-based enforcement only applies on your home network. On cellular data, the phone uses the carrier's DNS. Carrier controls — Verizon Family, AT&T Secure Family, T-Mobile FamilyMode — are the layer that follows the device off your home network.

Use a VPN. A VPN routes traffic around your router's DNS settings, bypassing network-level SafeSearch enforcement. A child with a VPN installed can circumvent the router layer. Note: a VPN does not bypass Family Link's account-level SafeSearch lock — that's enforced by Google's servers, not your DNS. The VPN apps guide covers detection and response.

Enable DNS over HTTPS in the browser. Chrome and Firefox support encrypted DNS (DoH), which routes DNS queries through a separate provider rather than your router. If a child enables DoH in Chrome's settings, router-based SafeSearch enforcement stops working. NextDNS's browser extension closes this gap specifically; a basic router DNS configuration does not.

Use incognito mode. Family Link blocks incognito mode automatically on supervised Android accounts and Chromebooks. On a shared desktop without Family Link supervision, incognito mode is available.

Sign out of Chrome. On Windows or Mac, a child can sign out of their supervised Chrome account and use Chrome without supervision active. The network-layer approach (Option 2) still applies; the account-layer approach (Option 1) does not.

What a VPN bypasses — and what it does not

A common parent question: "If my child uses a VPN, does it undo everything?"

Enforcement type	VPN bypasses it?
Router DNS enforcement (forcesafesearch.google.com)	Yes
NextDNS	Yes, unless the NextDNS browser extension or profiles are used
Family Link account-level SafeSearch lock	No — enforced by Google's servers
Family Link Chrome website filter	No — enforced by Google's servers
Chrome Enterprise policy (ForceGoogleSafeSearch)	No

Account-level Family Link controls are more VPN-resistant than DNS-level controls, because they're enforced by Google, not your router. The tradeoff is that account-level controls only work when the child is signed into their supervised account.

The four-layer stack for browser safety

No single setting covers everything. The effective setup layers all four:

Account level (Family Link): SafeSearch locked to Filter; Chrome web filter set to "Try to block explicit sites"; incognito blocked. This covers the most common accidental exposure cases for supervised children.
OS level: Make Chrome the only available browser on your child's device; remove or block other browsers. On Android, Family Link's app approval controls block installation of unauthorized apps from the Play Store. On Windows or Mac, Windows 11 parental controls or macOS Screen Time can restrict which apps are installed.
Network level (DNS): SafeSearch enforcement via router DNS, Google Nest WiFi Family Wi-Fi, or NextDNS. Catches cases where the account layer is bypassed (signed-out browser, different browser), covers all browsers, and enforces on the home network for every device. Pair with carrier controls to extend filtering to cellular data.
The conversation: Controls set expectations; conversation builds judgment. The goal is a child who comes to you when something unexpected appears — not one who hides it. That requires them to trust that your response to an accidental discovery is "thanks for telling me," not a punishment for what they saw.

What the controls honestly don't cover

AI Overviews and AI Mode. As described above, SafeSearch does not govern the AI layer on Google Search. Currently there is no Family Link control for it.
Direct URL navigation. A child who already knows the address of a site types it directly — no search needed. DNS-based filtering at the network level (block adult content using DNS) is the primary defense here.
Devices you don't control. School devices, friends' computers, and public library computers are outside your reach. Carrier controls and the conversation are the only coverage that travels with your child.
Images shared peer-to-peer. A friend can send an explicit image through messaging apps regardless of what any search filter does. Content shared directly bypasses all search-level filtering.
Other search engines, unsupervised. If a child knows to go to Bing or DuckDuckGo on a device where Family Link isn't active, no Google-side control reaches them.
Content on sites that aren't primarily explicit. SafeSearch filters pages whose primary content is explicit. Reddit, Twitter/X, and Discord have explicit content that lives inside platforms with other content — their own platform-level settings are the relevant control surface. See Reddit parental controls and Discord setup.

What to actually talk to your teen about

Controls are a starting point. The conversation is what makes them stick.

A few things worth saying plainly:

"These filters aren't here because I don't trust you. They're here because the internet is designed to surface things you didn't go looking for — and because of the way AI search works now, that's more true than it used to be."
"If something unexpected appears, you're not in trouble for seeing it. Tell me."
"Google now uses AI to answer questions, and that AI doesn't follow the same rules the search results do. It's something to be aware of."

The most effective protection is a child who tells you when the controls fail — because they eventually will. That requires them to believe the conversation won't become a punishment for what they encountered.

Tonight's 3-action checklist

Action 1: Open the Family Link app → your child's name → Controls → Google Search. Confirm SafeSearch is set to Filter. If your child doesn't have a Family Link account, check whether your router supports DNS-based SafeSearch enforcement, or set up NextDNS for Families.

Action 2: While in Family Link, tap Controls → Google Chrome and Web. Set the filter to "Try to block explicit sites" at minimum. Tap Manage sites and add any sites you want to specifically allow or block for your household.

Action 3: On your child's device, open Chrome → Settings → Privacy and Security → Security. Set Safe Browsing to Enhanced Protection. Do the same on your own devices and any shared family computers — Enhanced Protection is a security step for everyone, not just kids.