Section 1
The Assumption Gap
When a school issues a Chromebook, many parents assume that the school's IT team has it locked down completely — that web filtering and content restrictions apply at all times. The reality is more complicated and depends heavily on how your specific school has configured its devices.
The most common situation: school Chromebooks are managed via Google Workspace for Education and filtered via a school-managed DNS or web filter. These controls apply whenever the device is on the school network and signed in with the school account — but when the Chromebook comes home and connects to your home Wi-Fi, the picture changes.
Before assuming anything about your child's school-issued Chromebook, email the school's IT coordinator and ask: "Do the web content filters on our child's school Chromebook apply when they're at home on a personal network?" The answer varies by school and is worth knowing directly.
Section 2
School-Managed Chromebooks
If the Chromebook is enrolled in your school's Google Workspace for Education domain (you'll typically see the school name when it boots), the school has administrative control over it. Here's what that usually means:
Web filtering (varies)
Schools typically use a DNS or proxy-based filter. Some extend to home networks via a Chromebook extension that filters all browsing regardless of location. Others only filter on the school network. Ask which type your school uses.
App and extension control
Schools can restrict which Chrome extensions and Android apps can be installed. Your child may not be able to install a VPN or ad blocker on the school account — which is actually a feature from a safety perspective.
Guest mode may be disabled
School-managed Chromebooks often disable Guest Mode — meaning the device can only be used with the school account, keeping all managed controls in effect.
Personal accounts may be blocked
Some schools block students from signing in with personal Google accounts on the school device — useful for preventing them from bypassing school-managed restrictions.
On the Chromebook: click the clock in the bottom right → Settings → About ChromeOS → scroll down. If it says "This device is managed by [school name]" your school has administrative control. If it says "This device is not managed," it's either a personal device or the school hasn't enrolled it properly.
Section 3
The Home Network Gap
Even well-managed school Chromebooks often have a gap when used at home. Here are the main scenarios and what to do about each:
School filters work via a Chromebook extension (best case)
Some schools deploy a browser extension that filters web content regardless of network. If your school does this, the controls follow the device home. Confirm this is the case, and check that your child can't disable the extension (managed extensions typically can't be removed).
School filters only work on the school network
If filtering is network-based only, your home router controls are the backstop. Make sure your router's content filtering is configured — and consider a DNS filtering service like NextDNS that covers home devices comprehensively. See the router guide and filtering services guide.
Your child signs into a personal account on the school device
If the school hasn't blocked personal Google accounts, your child may be able to add their personal account to the Chromebook, which bypasses school-managed restrictions entirely. Check whether a personal account is signed in alongside the school account.
Late-night use on a school device
School Chromebooks aren't subject to your device-level Screen Time or Family Link controls. Your router's time-based controls are the most effective tool for limiting when the school Chromebook can access the internet overnight.
Section 4
Personal (Non-School) Chromebooks
If your family owns a Chromebook that isn't school-issued, you have direct control over it via Google Family Link. The same supervised account setup that applies to Android phones applies here — a supervised Google account on the Chromebook inherits all Family Link restrictions.
Set up a supervised Google account for your child
Via Family Link (see the Android guide). This supervised account, when signed into the Chromebook, applies all Family Link restrictions — SafeSearch, content filters, app approvals.
Sign the Chromebook into the supervised account
On the Chromebook login screen, sign in with your child's supervised Google account. The Family Link restrictions apply immediately.
Disable Guest Mode
Settings → Privacy and Security → scroll to "Manage other people" → disable Guest browsing. This prevents your child from using the device in an uncontrolled guest session.
Restrict signing in as other users
Settings → Manage other people → enable "Restrict sign-in to the following users" and list only your child's supervised account. This prevents adding an unrestricted personal account.
Even well-configured personal Chromebooks benefit from router-level controls as a secondary layer. Configure your router to filter content for the Chromebook's device specifically, and use time-based controls to cut off internet access overnight. This covers gaps that device-level settings miss.
Section 5
A Note on AI Tools and Chromebooks
Chromebooks are primarily web-based devices, which means they have access to every AI chatbot tool via the Chrome browser — ChatGPT, Character.ai, Google Gemini (which is now built into Google accounts), and others. School-managed Chromebooks may block some of these via the school's web filter, but many don't.
If AI tool use and academic integrity are concerns at your child's school, it's worth asking specifically whether tools like ChatGPT are blocked on the school Chromebook, and whether that block extends to home use. See the AI chatbots guide for a broader discussion of this topic.
Ask the school first. Then fill the gaps yourself.
The school IT team knows what they've configured — ask them directly. Once you know what applies and what doesn't, filling the gaps with router controls and supervised accounts takes the guesswork out of it.