Does Your Kid Have a Secret Gmail?

You set the screen time limits. You installed the filters. You had the talk. And then one day you glance over your child's shoulder and notice an unfamiliar Gmail address — one you've never seen before and certainly never approved.

It happens more often than parents expect. Creating a secondary email account is one of the most common ways kids sidestep digital ground rules, and Gmail makes it remarkably easy. This post breaks down why kids do it, and more importantly, how to stop it across every device and router in your home.

---

Why Kids Create Secret Gmail Accounts

Understanding the motivation helps you choose the right response. The most common reasons include:

Bypassing parental controls on apps. Google Family Link, Microsoft Family Safety, and Apple Screen Time all tie restrictions to a specific account. A second, unsupervised Google account on the same Android phone or Chromebook lets a child download apps, access YouTube without filters, and browse Chrome without restrictions — all while appearing compliant to a parent checking the supervised account dashboard.

Accessing age-gated content. Many platforms — YouTube, Discord, TikTok, gaming sites — require users to confirm they are 13 or older. A fresh Gmail account lets a child set their own birthdate and bypass those gates entirely.

Communicating without oversight. Parents who monitor their child's known Gmail through Family Link will miss everything happening in a second inbox. Secret accounts are also used to create anonymous profiles on social platforms and to communicate with people the child knows a parent would question.

Keeping purchases hidden. Apps, in-game purchases, and subscriptions bought through a secondary Google account never appear in a parent's Family Link activity feed.

The challenge for parents is that Google allows anyone who claims to be 13 or older to create a standard (unsupervised) Google account with no parental involvement required. That means the barrier is just a few taps and a fictional birthdate.

---

The Central Problem: You Can't Simply Block accounts.google.com

The instinct to block accounts.google.com at the router or firewall level is understandable, but it comes with a serious catch: that same domain handles all legitimate Google sign-ins. If you block it entirely, your child (and everyone else on the network) will be unable to sign into Gmail, Google Drive, YouTube, Google Classroom, Google Meet, and virtually every other Google service. For households and students who depend on Google Workspace for Education, this would be crippling.

The smarter approach is to combine device-level supervision (which controls the account already on the device) with selective domain blocking (which targets only the account creation flow), and to layer those controls across multiple platforms so that no single bypass works cleanly. Let's go platform by platform.

---

Blocking Secret Account Creation: By Platform

Windows PC

Microsoft Family Safety is a free service that covers Windows, Xbox, and Android devices with a range of parental tools including content monitoring, screen time limits, and website filtering. It allows parents to monitor online activity, limit screen time, block unsafe websites, control app usage, and track device location. Once set up, parental controls apply to every device the child logs into with their Microsoft Account.

Using Microsoft Family Safety:

1. Visit family.microsoft.com and sign in with the parent account.
2. Select your child's profile and go to Content filters > Web browsing.

3. Enable filtering and add the following to the blocked list:

   • accounts.google.com/signup
   • accounts.google.com/lifecycle/steps/signup

Because these are specific signup paths (not accounts.google.com itself), normal Google sign-ins should continue to work for your child's known account.

Set the child account as a Standard User (not Administrator): Go to Settings > Accounts > Family & other users, select the child's account, and confirm the account type is "Standard User."

---

Mac

Apple's Screen Time feature lets parents customize downtime, set app limits, create communication limits, block or restrict content, and allow or restrict websites. After turning on Screen Time and creating a passcode, you can add parental controls to keep your child's device usage safe, private, and age appropriate.

Setting up Screen Time on macOS:

1. Open System Settings > Screen Time.
2. Select your child's account (if using Family Sharing) and turn on Screen Time with a passcode.
3. Go to Content & Privacy > Content Restrictions > Web Content.
4. Select Limit Adult Websites or Allowed Websites Only (most restrictive).
5. Under "Restricted," add accounts.google.com/signup.

---

Chromebook

Chromebooks are tightly integrated with Google accounts, which makes them both powerful and tricky to lock down. Configuring Google Family Link on a Chromebook involves creating a supervised child account and linking it to the parent's Family Link app before the child signs into the device. This process requires Chrome OS version 65 or higher. Once set up, Family Link provides three website filtering options: allow all sites, try to block mature content, or only allow approved sites — the most restrictive setting requiring you to manually approve every website your child wants to visit.

Critical Chromebook steps:

1. Open the Family Link app on your phone.
2. Go to your child's profile > Controls > Google Chrome and Web.
3. Under "Manage Sites," tap Blocked Sites and add: accounts.google.com/signup
4. Confirm that Incognito mode is disabled — this is automatically enforced on supervised accounts managed by Family Link.

---

iOS (iPhone / iPad)

Apple's Screen Time feature is used by over 50 million families worldwide. With Family Sharing set up, parents can manage most settings directly from their own device, ensuring consistent protection across all Apple devices in the household.

Setting up iOS Screen Time to block Gmail signup:

1. On your child's iPhone/iPad, go to Settings > Screen Time > Turn On Screen Time.
2. Tap This is My Child's iPhone, then set a Screen Time passcode — different from the device passcode.
3. Go to Content & Privacy Restrictions > Content Restrictions > Web Content.
4. Select Limit Adult Websites.
5. Under Add Website in the "Never Allow" section, add: accounts.google.com/signup

---

Android

Android's parental controls live inside Google Family Link, which supervises the child's Google account rather than the device itself. With Family Link, parents can manage a child's apps on supervised devices — deciding which apps can be downloaded or purchased, blocking or allowing apps, and changing app permissions. Parents can also manage screen time, set a bedtime or daily screen limits, and check how much time the child spends on certain apps.

To lock down Gmail account creation on Android:

1. On the parent's phone, open the Family Link app and select your child.
2. Go to Controls > Google Chrome and Web > Manage sites > Blocked sites and add: accounts.google.com/signup
3. Under Controls > Apps, block the child from installing third-party browsers that might bypass Chrome's website filters.
4. In Controls > Account Settings, make sure "Allow child to change account settings" is turned off.

---

Router & Firewall Controls

Router-level blocking is your broadest line of defense because it applies to every device on your home network simultaneously — phones, tablets, laptops, gaming consoles, and smart TVs. The key limitation is that it only applies when devices are on your home Wi-Fi, not on cellular data or another network.

The target domains to consider blocking (without breaking logins):

• accounts.google.com/signup
• accounts.google.com/lifecycle/steps/signup
• accounts.google.com/v3/signin/accountchooser

Amazon Eero (eero Secure)

Eero's parental controls offer content filters, family profile management, time management, real-time threat blocking, and ad-blocking. Content filtering is available via the eero Secure subscription, which includes a "Block and Allow Sites" feature for targeted domain blocking.

1. Open the Eero app and tap Security & Privacy > Network Controls > Block & Allow Sites.
2. Tap Add Blocked Site and enter accounts.google.com.
3. Assign this rule to the child's family profile only, leaving adult profiles unaffected.

For more targeted path-level blocking, pair eero with NextDNS configured as the upstream DNS, which allows blocking specific URL paths rather than entire domains.

NETGEAR Orbi / Nighthawk

NETGEAR Smart Parental Controls (subscription-based) runs through the Orbi and Nighthawk apps. In the app, navigate to Parental Controls, select the child's profile, go to the History tab, and swipe right on a website to set it as "Not Allowed" — blocking it at all times for that profile.

For blocking specific signup pages via the web interface:

1. Log into orbilogin.com (or orbilogin.local for newer models).
2. Go to Advanced > Security > Block Sites.
3. Add accounts.google.com/signup to the block list.

TP-Link Deco (HomeShield)

TP-Link HomeShield parental controls, managed through the Deco app, allow parents to block specific websites per child profile. Note that TP-Link requires the full domain name — for example, www.facebook.com rather than just "facebook."

1. Open the Deco app and go to Parental Controls.
2. Select your child's profile and navigate to Blocked Websites.
3. Add accounts.google.com (be aware this will block the full domain including logins — see caveat above).
4. For path-level targeting, configure a custom DNS server in the router's WAN settings and pair with NextDNS.

ASUS (AiProtection)

ASUS routers offer Web & Apps Filters under AiProtection, allowing per-device URL blocking with content category filtering powered by Trend Micro. Time Scheduling lets you also restrict internet access hours per device using MAC address identification.

1. In a browser, navigate to http://www.asusrouter.com or your router's LAN IP (typically 192.168.1.1).
2. Go to AiProtection > Parental Controls > Web & Apps Filters.
3. Select the child's device by MAC address.
4. Add accounts.google.com/signup under blocked URLs.

Google Nest Wifi / Google Wifi

Google's own mesh system focuses on adult content category blocking and scheduled internet pauses rather than per-domain custom blocking. Its built-in Family Wi-Fi controls allow you to pause internet access and block adult content, but surgical per-path domain blocking requires an external DNS service.

Best approach for Google Nest Wifi:

1. Open the Google Home app.
2. Tap your network > Settings > Advanced Networking > DNS.
3. Enter the DNS IPs for NextDNS or CleanBrowsing Family Filter (185.228.168.168 / 185.228.169.168).

Ubiquiti UniFi

UniFi provides the most granular control of any router covered here, with DNS-level content filtering, custom traffic rules, and VLAN segmentation.

1. Go to Settings > CyberSecure > Content Filter and create a filter policy for the children's network or devices.
2. Enable Safe Search integration for Google, Bing, and YouTube.
3. Go to Settings > Traffic & Security > Traffic Rules and create a Block rule for the child's device group targeting accounts.google.com/signup.
4. For best results, create a separate Kids VLAN and assign all children's devices to it, applying stricter rules to that VLAN only.

DNS Filtering Services (Works on Any Router)

DNS-level filtering sits between your devices and the internet, regardless of what browser, OS, or app is in use. It works on any router that allows you to set custom DNS servers.

• CleanBrowsing Family Filter (free): 185.228.168.168 / 185.228.169.168
• NextDNS (free tier, then paid): Highly customizable with per-device reporting and path-level blocking.
• Cloudflare for Families (free): 1.1.1.3 (malware + adult content) or 1.1.1.2 (malware only).

To use these, log into your router's admin panel and update the DHCP/WAN DNS server settings to point to the filtering service's IP addresses instead of your ISP's defaults.

---

Advanced Section: Power User Controls

The following methods require working in the command line, Windows Registry, or low-level system files. They are harder for kids to reverse and persist even across browser changes or VPN attempts when implemented correctly.

Windows: Editing the Hosts File

The Windows hosts file acts as a local DNS override — anything listed there is resolved locally before the device ever contacts an external DNS server.

Location: C:\Windows\System32\drivers\etc\hosts

To edit (requires Administrator):

1. Search for Notepad, right-click it, and choose Run as Administrator.
2. Open the file at the path above.
3. Add the following line at the bottom:

0.0.0.0    accounts.google.com

Protect the hosts file from modification (run as Administrator):

icacls "C:\Windows\System32\drivers\etc\hosts" /inheritance:r /grant:r "SYSTEM:F" "Administrators:F"

Flush the DNS cache after any change:

ipconfig /flushdns

Windows: Registry-Based URL Blocking for Edge and Chrome

For Microsoft Edge — block specific URLs via Registry:

1. Open Registry Editor (regedit.exe) as Administrator.
2. Navigate to (or create): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist

3. Add a new String Value:

   • Name: 1
   • Data: accounts.google.com/signup/*

For Google Chrome — block URLs via Registry (Chrome Policy):

1. Navigate to (or create): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\URLBlocklist

2. Add a new String Value:

   • Name: 1
   • Data: accounts.google.com/signup/*

This applies Chrome's built-in policy-level block, which cannot be overridden within Chrome — even in Incognito mode. To verify Chrome is reading the policy, open Chrome and navigate to chrome://policy.

Standard user accounts cannot write to HKEY_LOCAL_MACHINE by default, making these entries tamper-resistant as long as the child account does not have administrator rights.

Mac: Terminal Hosts File Edit

To edit via Terminal:

sudo nano /etc/hosts

Add at the bottom:

0.0.0.0    accounts.google.com

Save with Ctrl+O, exit with Ctrl+X.

Flush the DNS cache:

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Set the hosts file as immutable to prevent modification:

sudo chflags uchg /etc/hosts

Router-Level: Intercept DNS Bypass Attempts

Children who know about DNS can change their device's DNS settings to use a public resolver like 8.8.8.8, bypassing your router's DNS filter entirely. On routers running OpenWRT, DD-WRT, or pfSense, add these iptables rules to force all DNS traffic back through the router:

# Redirect all DNS queries from kids' VLAN to the router's DNS
iptables -t nat -A PREROUTING -s 192.168.10.0/24 -p udp --dport 53 -j REDIRECT --to-port 53
iptables -t nat -A PREROUTING -s 192.168.10.0/24 -p tcp --dport 53 -j REDIRECT --to-port 53

Replace 192.168.10.0/24 with your children's VLAN subnet.

Block common DNS over HTTPS (DoH) providers to prevent encrypted DNS bypass:

iptables -A FORWARD -d 8.8.8.8 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 1.1.1.1 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 9.9.9.9 -p tcp --dport 443 -j DROP

Block VPN Usage at the Router

A VPN is the single most effective bypass tool a tech-savvy child can use. Common VPN ports to block for children's devices:

• UDP/TCP 1194 — OpenVPN
• TCP 1723 — PPTP
• UDP 500, 4500 — IKEv2/IPsec
• TCP/UDP 51820 — WireGuard

On ASUS, UniFi, pfSense, and OpenWRT routers, you can block outbound traffic on these ports for specific devices or VLANs. Note that some VPN services route through port 443 (standard HTTPS), making them harder to block without deep packet inspection.

---

A Note on the Bigger Picture

No technical control is permanent. Devices get reset. Friends have unrestricted Wi-Fi. Cellular data bypasses every home router filter. And once a child turns 13, they can remove Google parental controls from their account entirely — making the supervised period a window of time, not a permanent lock.

The most durable protection is a combination of layered technical controls and ongoing conversation. Kids who understand why rules exist — not just that they exist — are less motivated to invest in circumventing them. The goal isn't to build an unbreakable cage; it's to create enough friction that impulsive decisions slow down, while keeping the lines of communication open enough that your child brings questions to you rather than to a secret inbox.

Use the tools above as a foundation. Revisit them regularly, because both the technology and your child's technical knowledge will evolve. And when you find that secret account anyway — treat it as a starting point for a conversation, not just a reason to add more firewall rules.

---

Have questions about setting this up for your specific device or router model? Leave a comment below or reach out to our team — we're happy to walk you through it.