Layer 4 of 7 — you are here
4
Last verified: July 7, 2026
Day Four · Companion to Chapter 7
Streaming & Consoles
Streaming apps bring their own content past your DNS wall — the wall sees "netflix.com," not what's playing. So Layer 4 goes inside each service. The pattern is the same everywhere: kid profiles pinned to a maturity tier, adult profiles locked behind a PIN, and profile creation restricted where the service allows it. Work down your Inventory's Services list.
Per-service lockdown
Menu paths move constantly in streaming apps — of everything on this site, this section will churn the most. Paths below were current at the "Last verified" date; the web/account-settings versions are usually more complete than the TV-app versions, so do this from a browser where possible.
Netflix
- netflix.com → Account → Profiles → Adjust parental controls (or go straight to netflix.com/settings/restrictions) → pick the profile → set the Maturity Rating ceiling, or use a dedicated Kids profile.
- Set a Profile Lock PIN on every adult profile. An unlocked adult profile one click away makes the kids profile decorative.
- Block specific titles per profile if needed (Title Restrictions, in the same parental-controls area — web only for Kids profiles).
Disney+
- Profile → Edit Profiles → child profile → turn on Junior Mode (Disney's current name for the kids profile), or set a Content Rating ceiling.
- Turn on Kid-Proof Exit — kids can't hop out of Junior Mode without passing an exit challenge.
- PIN-protect adult profiles (Profile → Profile PIN, 4 digits).
Hulu
- Child profiles: mark the profile as a Kids profile at creation (an under-13 birthdate does this automatically).
- Hulu's teen middle ground is thin: 13–17 profiles hide R/TV-MA based on birthdate, but there's no configurable rating ceiling — so a 14-year-old's profile leans on the device backstop.
- PIN-lock adult profiles: Manage Profiles → PIN Protection. One caveat: it's a single account-wide PIN across all protected profiles — anyone who learns it for one has it for all.
Prime Video
- Web: Prime Video settings → Parental Controls → set a Prime Video PIN.
- Set Viewing Restrictions by rating tier — and note Amazon's own docs: the PIN applies account-wide, but viewing restrictions apply only to the devices you select. A forgotten Fire TV can be more permissive than the phone app. Check every registered device.
- Purchase controls: require the PIN for purchases (Amazon sells things inside the video app; treat it like a store, because it is one).
Peacock
- Kids profiles pin to kid content, and per-profile maturity tiers run Little Kids → Older Kids → Family → Teen → Adult, enforced by a Parental Controls PIN set in account settings. Rating tiers only — no per-title blocking.
ESPN / sports apps
- Here's the honest note: the ESPN app has no parental controls at all — no kids mode, no purchase PIN. Pay-per-view purchases are gated only by account sign-in and your platform's store PIN, so the real controls are the device layer (Layer 3), store-level ask-to-buy (Layer 2), and the device-under-the-TV PINs below. ESPN content inside Disney+ does inherit Disney+ profile controls.
Roku / Fire TV (the device under the TV)
- Roku: set a Roku account PIN (my.roku.com) and require it for purchases, rentals, and adding apps; Roku's rating-based parental controls gate The Roku Channel only. Each installed app still carries its own profile system — the Roku PIN doesn't reach inside Netflix.
- Fire TV: Settings → Preferences → Parental Controls → on. The PIN gates purchases, app launches by rating, the Photos app, and Prime Video viewing restrictions. Same caveat: it gates the device shell, not the inside of third-party apps.
Strong walls vs. soft walls
Not all services lock down equally. Plan accordingly:
| Holds well | Leans on the device backstop |
|---|---|
| Netflix (granular ratings + profile locks) · Disney+ (kids profiles + exit protection) · Prime Video (PIN + restrictions, once every device is covered) | Hulu (thin teen tier) · sports apps (no content machinery) · any service where adult profiles can't be PIN-locked — there, Layer 3 and the network wall are doing the real work |
Console maps: the full control surface
The trap
Console parental controls are split across surfaces. Finishing the app is not finishing the console.
Nintendo Switch
| Surface | What lives there |
|---|---|
| Nintendo Switch Parental Controls app (phone) | Play-time limits, bedtime alarm, content rating ceiling, social feature restrictions, suspend-software enforcement. |
| Nintendo website (account settings) | eShop purchase restrictions and spending controls live here, NOT in the app: parent account → family group → child's settings. This is the flagship example of the split — parents finish the app and never find the store settings. (Still true on Switch 2.) |
| The console itself | System Settings → Parental Controls: the on-device PIN, and the link to the app. |
PlayStation
| Surface | What lives there |
|---|---|
| PlayStation Family accounts (web account management → Family Management, or the PS App) | Child accounts inside a PSN family, age-based defaults, play-time schedules, monthly spending limits (default $0 — purchases above it need family-manager approval), communication controls. |
| The console | Settings → Family and Parental Controls → PS5 Console Restrictions, guarded by the system restriction passcode — change it from the factory default (0000), or the web settings can be sidestepped by making a new local user on the console. |
Xbox
| Surface | What lives there |
|---|---|
| Xbox Family Settings app + Microsoft Family Safety | Split alert: Microsoft removed Xbox controls from the Family Safety app in early 2026 — Xbox-specific remote controls (content ratings, screen time, spending) now live in the dedicated Xbox Family Settings app. Family Safety still owns the child Microsoft account, web filters, and Windows screen time. |
| The console | Profile & system → Settings → Account → Family settings; the purchase/settings pass-key is under Settings → Account → Sign-in, security & passkey. Set it, plus guest/new-account restrictions. |
Smart displays and TV sticks
- Content filters: on Echo devices the kid mode is Amazon Kids (per-device, with explicit filtering and a Parent Dashboard); on Google speakers/displays it's Parental controls & Digital wellbeing in the Google Home app (media filters for music, video, news — full parental controls need a family group + supervised child account). Turn them on for any display a kid can reach.
- Voice purchasing: Alexa app → More → Settings → Account Settings → Voice Purchasing → off, or require the 4-digit Voice Code (know that the code gets spoken aloud). Google Home app → Assistant settings → Payments → Purchase approvals. A four-year-old can order things by asking nicely.
- The built-in browser problem: many smart TVs, displays, and sticks ship with a quiet little web browser that has no parental controls at all. At home, your network wall covers it — this is exactly why Layer 1 came first. It's also why the New-Device Protocol says no device touches the network before Layer 1 applies.
- Guest mode: guest modes on these devices bypass account rules (your profiles, your purchase PINs) but NOT the network wall — DNS filtering doesn't care who's signed in. Know which wall is holding when guests visit.
Known gaps — the living list
Some filters guard one sense and not another. These are confirmed gaps, kept current here as vendors fix (or don't fix) them:
- Apple Music lyrics: the explicit-content filter blocks explicit audio — but written lyrics still leak through via mislabeled "clean" tracks, lyric search results, and explicit titles/artwork in browse. The filter guards ears, not eyes. Community-documented for years; no Apple fix as of the verification date above.
- Music videos inside streaming apps: rating systems for music videos are inconsistent across services — a TV-rating ceiling may not apply to them. [VERIFY: per-service]
- Live sports ads: no filter anywhere governs what airs in a commercial break. Not fixable by settings; worth knowing.
- Found a gap? It belongs on this list — check updates for additions.
Done when
- Every service on the Inventory has kid profiles tiered, adult profiles PIN-locked, and profile creation restricted where offered.
- Every console is configured on all of its surfaces — app, website, and the console itself.
- Voice purchasing is off or PIN-locked on every assistant.
- You know which of your services are soft walls, and the device backstop covers them.