How on-device content filtering works (and why it's different from cloud filtering)
Photo by FlyD on Unsplash
Most parental control apps say some version of "blocks inappropriate content" — it's easy to assume that's one thing. It isn't. Where the filtering decision happens, on the device or on a server it talks to, changes what data leaves the phone.
The mechanism: DNS resolution
Every time an app opens a web address, the device first resolves that address to a server location — DNS resolution. Content filtering almost always works by intercepting that step: check the domain's category, then either let it resolve or block it. True whether filtering is on-device or cloud-based — the difference is where that check happens.
Cloud filtering: the check happens on someone else's server
The device sends DNS requests out to a third-party filtering service, which checks and responds. This works, but every domain your kid's device tries to reach passes through an external company's servers first. Not necessarily sinister — but a running log of your family's browsing now exists on infrastructure you don't own and didn't set the retention policy for.
On-device filtering: the check happens on the phone
A blocklist lives on the device, gets checked locally, decision made right there — nothing round-trips to an external server for the purpose of filtering. Browsing activity doesn't get routed through a third party as part of how the filter works. Not a promise layered on top — what the mechanism actually does.
The honest tradeoff
Cloud services update centrally and can apply more sophisticated (ML-based) classification; an on-device blocklist is only as current as its last update. For most parents, "which category does this domain fall into" is a solved-enough problem that the currency tradeoff is small — the privacy tradeoff is the one that actually matters day to day.
What neither approach covers
Content filtering blocks by domain category — it doesn't evaluate posts or messages inside an already-allowed app. That's a fundamentally different, much harder problem than category-level blocking.
Five questions to ask any parental control app about filtering
Marketing pages rarely say where filtering happens, so ask directly. A trustworthy answer is specific and easy to find.
- Where is the decision made? On the phone, or on the company's servers?
- What is logged, and for how long? A filter that keeps a browsing history holds a detailed picture of your family.
- Does it work on both Wi-Fi and mobile data? A filter that only covers home Wi-Fi leaves the rest of the day open.
- Can it be switched off without a PIN? A control your child can disable in Settings isn't much of a control.
- What does it do when the blocklist is out of date? Ask how often categories refresh and how you can report a site that slipped through.
None of these need a technical background to ask, and the way an app answers usually tells you how seriously it takes privacy.
How does Paxio filter content on the device?
Paxio's content filtering resolves DNS locally — blocklist on the phone, category check on the phone, browsing activity never routed through a third party as part of how it works. One of Paxio's core controls, alongside screen time, app blocking, and bedtime scheduling.
"Does this filter on the device or in the cloud" is a fair, concrete question to ask any parental control app.
Frequently asked questions
What is on-device content filtering?
It means the blocklist and the category check both live on the phone, so filtering doesn't depend on sending your family's browsing to a third-party server.
Is DNS filtering effective for kids?
Yes for blocking categories of websites such as adult content or gambling. It doesn't evaluate posts or messages inside an allowed app.
What's the difference between cloud and on-device filtering?
Cloud filtering checks each domain on the provider's servers, so your browsing passes through them. On-device filtering makes the decision locally.
For the full picture of how this fits alongside app blocking and screen time limits, see our guide on what a parental control app is.