Think You Know What’s On Your Child’s Android Phone. The Home Screen Doesn’t Tell The Whole Story, Learn What Can
CAVEAT: Here at The White Hatter, we recognize that parenting in today’s digitally connected world requires a balance between respecting a young person’s growing need for privacy and independence, while also fulfilling our responsibility to help keep them safe. As technology becomes increasingly integrated into the lives of our children, parents and caregivers are often faced with difficult questions about how much oversight is appropriate, when they should become more involved, and where the line exists between responsible parenting and unnecessary intrusion. We believe the answer is not found in any single parental control, monitoring application, or device setting. Rather, it begins with building a relationship grounded in trust, open communication, mutual respect, and age-appropriate accountability. When children know they can approach a parent or caregiver without immediately facing judgment, punishment, or the loss of their device, they are more likely to seek help when something uncomfortable, confusing, or potentially harmful happens online.
At the same time, we also recognize that trust should not be confused with turning a blind eye to legitimate safety concerns. There may be circumstances where a parent or caregiver has reasonable grounds to look more closely at how their child’s Android phone is being used, particularly when there are noticeable changes in behaviour, unexplained secrecy, or indications of cyberbullying, online grooming, sextortion, coercion, threats, or other forms of technology-facilitated victimization. In these situations, having a basic understanding of how Android devices store information, manage applications, and retain certain activity records can be extremely valuable. However, it is equally important to recognize that discovering a hidden application, deleted conversation, or unfamiliar website does not automatically establish that a child has done something wrong. Digital information often lacks the context necessary to understand what actually occurred, and making assumptions without that context can unnecessarily damage the very trust we should be working to strengthen.
Our intention with this article is not to provide parents and caregivers with a roadmap for secretly investigating every aspect of their child’s digital life. Instead, we want to increase their understanding of the Android operating system and highlight 15 potential digital breadcrumbs that may be relevant when a legitimate safety concern arises. We explain where these breadcrumbs may be found, what information they might provide, and the important limitations parents should understand before drawing conclusions. We believe that informed parental oversight, when exercised reasonably, proportionately, and with consideration for a child’s age and maturity, can complement rather than undermine a trusting parent-child relationship. The objective should never be to turn parenting into an ongoing digital investigation, but rather to use knowledge and technology as tools that support meaningful conversations, responsible decision-making, and the gradual development of digital independence.
This article is also a companion piece to our previously published iPhone guide, titled “Think You Know What’s On Your Child’s iPhone? The Home Screen Doesn’t Tell the Whole Story, Learn What Can” (1). Although both articles share the same underlying philosophy of balancing online safety, privacy, and parental responsibility, Android and Apple’s iOS operating systems differ significantly in how applications, privacy features, and device activity are managed. Unlike Apple’s iPhone ecosystem, Android is used by multiple manufacturers, including Samsung, Google, Motorola, OnePlus, and others. Although these devices share many underlying Android features, manufacturers frequently customize their interfaces, privacy settings, application management tools, and parental controls. The instructions in this guide are based on commonly documented Android features available through October 2026, including Google’s Android and Digital Wellbeing systems, Google Family Link, and Samsung Galaxy features. The exact location, appearance, and availability of settings may differ depending on the phone’s manufacturer, Android version, security updates, Google Account configuration, and whether parental supervision has been enabled. Some features discussed below may not be available on every Android phone.
We felt it was important to provide parents and caregivers whose children use Android devices with their own practical, platform specific resource rather than assume that the same information and instructions apply equally to both operating systems.
1/ Start With the App Drawer, Not the Home Screen
Where to look: On most Android phones, swipe upward from the Home Screen to open the App Drawer. However, some manufacturers allow users to configure their devices without a separate App Drawer, while others provide different navigation methods. If swiping upward does not reveal an application list, parents should review the device’s Home Screen settings or consult the manufacturer’s instructions.
One of the first things parents and caregivers should understand is that an application does not have to appear on the Home Screen to remain installed and accessible on an Android phone. Most Android devices allow users to remove application shortcuts from the Home Screen without uninstalling the applications themselves. Consequently, looking only at the Home Screen provides an incomplete picture of what applications are actually available on the device.
The App Drawer generally provides a more comprehensive view of applications available within the current user profile. However, it is important to understand that the App Drawer is not necessarily a complete inventory of every application installed on the phone. Some manufacturers allow users to hide applications from the ordinary application list, while Android also supports separate profiles or protected spaces that may contain applications not visible in the main App Drawer.
For example, Samsung Galaxy phones include features that allow certain applications to be hidden from the Home Screen and Apps screen. Other Android manufacturers may provide similar functionality under different names or through different settings. If a parent discovers an unfamiliar application in the App Drawer, this is useful evidence that the application is available within the current device environment. However, it does not establish when the application was installed, who installed it, whether the child actively uses it, or what activities occurred within it.
What this breadcrumb can tell you: An application appearing in the App Drawer is evidence that it is available within the current Android user environment.
What it cannot prove: It does not establish who installed the application, when it was installed, whether the child uses it regularly, or what occurred within it.
2/ Check for Hidden Applications
Where to look: On supported Samsung Galaxy devices, open Settings and search for “Hide apps.” Depending on the version of Samsung’s One UI software, the feature may appear under Home Screen settings or another application visibility menu. Other Android manufacturers may offer similar functionality under different names, while some devices may not provide a built-in app-hiding feature.
Some Android phones allow users to hide applications from the Home Screen and ordinary application listings without actually uninstalling them. This is different from deleting an application because the application may remain installed and accessible through other parts of the operating system. On supported Samsung Galaxy devices, for example, applications can be hidden from the Home Screen and Apps screen through the manufacturer’s Home Screen settings. This means that a parent who looks only at the ordinary application list may not see every application that remains installed.
Parents and caregivers should understand that hiding an application icon is not necessarily the same as protecting the application with a password, fingerprint, or separate security environment. On some Android devices, hidden applications remain accessible through the operating system’s application management settings. Other features, such as Google’s Private Space or Samsung’s Secure Folder, provide a more isolated environment for applications and their associated data.
Other Android manufacturers may provide their own app-hiding features, application lockers, or privacy settings. The precise functionality varies, and parents should not assume that instructions for one Android manufacturer will apply to another. It is also important to distinguish between hiding an application icon and placing an application inside a separate protected environment. Hiding an icon generally affects visibility within the ordinary interface, whereas protected spaces may isolate applications and their associated data from the main device environment.
Parents should also understand that hiding an application is not necessarily evidence of inappropriate behaviour. Privacy features can serve legitimate purposes, including preventing casual access to personal information or reducing clutter on the Home Screen.
What this breadcrumb can tell you: An application listed within a manufacturer’s hidden-app settings may be installed but intentionally concealed from ordinary application listings.
What it cannot prove: It does not establish that the application is being used inappropriately or that the child intended to conceal harmful behaviour.
3/ Check Android’s Private Space Feature
Where to look: On supported Android devices, open Settings → Security & privacy → Private space, or search Settings for “Private space.” Availability and navigation vary by manufacturer and Android version.
One of the more significant privacy developments within Android is Google’s Private Space feature, introduced with Android 15. Private Space allows users on supported devices to create a separate, protected environment for certain applications and their associated information. Unlike simply hiding an application icon, Private Space provides a more isolated environment within the phone. Applications installed inside Private Space are separate from their counterparts in the main device environment and can maintain separate application data and account sessions.
When Private Space is locked, applications within it are generally hidden from ordinary application listings and certain system interfaces. Depending on the configuration, the existence of Private Space itself may also be concealed from the normal application drawer. This distinction is important for parents and caregivers because reviewing the ordinary App Drawer, Digital Wellbeing information, or main-profile application settings may not provide a complete picture of applications contained within a separate protected space.
There is an important limitation involving supervised child accounts. Google documents that Private Space is unavailable in certain managed or supervised device configurations, including when the device’s primary user is supervised through Family Link. Consequently, parents should not assume that every child using Android 15 or later can automatically create and use Private Space. Its availability depends on the device, Android version, user profile, and whether the device is managed or supervised.
Parents should also understand that Private Space is not simply another folder containing hidden applications. It creates a separate environment in which applications can maintain their own data and account sessions, and activity within that environment may not be reflected in the same way as activity occurring in the main device profile.
The availability of Private Space settings may establish that the device supports the feature, while its configuration status may help determine whether a separate protected environment has actually been established. However, the existence of Private Space should not automatically be interpreted as evidence of wrongdoing. Like other privacy tools, it can serve legitimate purposes, including protecting sensitive personal information and separating different aspects of a person’s digital life.
What this breadcrumb can tell you: The availability of Private Space settings may establish that the device supports the feature, while its configuration status may indicate that a separate protected environment has been established.
What it cannot prove: It does not establish what applications are contained within the protected space, whether they have been used, or whether the child is engaging in inappropriate activity.
4/ Samsung Galaxy Users Should Understand Secure Folder
Where to look: On supported Samsung Galaxy devices, open Settings → Security and privacy → More security settings → Secure Folder, or search Settings for “Secure Folder.” The exact navigation may vary depending on the device and One UI version.
Samsung Galaxy phones have an additional feature that deserves particular attention because it operates differently from ordinary application hiding. Samsung’s Secure Folder provides a protected environment where supported applications, photographs, files, and other information can be stored separately from the main device environment. Secure Folder uses Samsung’s Knox security technology and can require separate authentication before its contents can be accessed.
One of the important characteristics of Secure Folder is that applications can exist both inside and outside the protected environment. For example, a user may have one instance of a messaging application in the ordinary phone environment and another instance within Secure Folder, potentially using different accounts. This means that examining the ordinary application list may not provide a complete picture of the applications or accounts being used within Secure Folder.
Secure Folder is available on supported Samsung Galaxy devices, but it should not be assumed that every Samsung phone includes this feature. Its availability depends on the device model, software version, and supported Samsung security functionality. Parents should also understand that hiding the Secure Folder icon does not necessarily remove every indication that the feature has been configured. However, accessing the applications and information contained within Secure Folder generally requires the appropriate authentication.
Secure Folder can also be configured so that its icon is not displayed in the ordinary application interface. Consequently, the absence of a Secure Folder icon does not necessarily establish that the feature has never been configured. Similarly, discovering that Secure Folder is available in the device’s settings does not necessarily establish that it has been configured or actively used.
Parents and caregivers should understand that Secure Folder has many legitimate uses. It can protect personal photographs, financial information, work documents, private communications, and other sensitive material. The feature itself is not evidence of inappropriate behaviour, and parents should avoid interpreting the presence of Secure Folder as an automatic indication that their child is attempting to conceal something harmful.
What this breadcrumb can tell you: Secure Folder settings may help establish whether a protected environment has been configured on a supported Samsung device.
What it cannot prove: They do not necessarily reveal the contents of Secure Folder, establish who configured it, or demonstrate that it is being used for inappropriate purposes.
5/ Check the Complete Application List in Settings
Where to look: Settings → Apps → See all apps, or Settings → Apps, depending on the manufacturer.
One of the more useful ways to review applications on an Android phone is through the operating system’s application management settings. Unlike the ordinary Home Screen or App Drawer, this section is designed to provide information about applications managed within the current Android user environment. Depending on the device, parents may be able to review installed applications, disabled applications, system applications, storage information, permissions, and other application-related settings.
This can be useful when an application does not appear in the ordinary App Drawer or when a parent wants to determine whether an unfamiliar application is installed. However, there are important limitations. Android supports multiple user profiles, work profiles, and protected environments. Applications associated with another profile or a locked protected space may not appear in the ordinary application list for the current user.
Parents may also encounter applications that have been disabled rather than uninstalled. A disabled application may remain installed on the device but be unavailable for ordinary use until it is enabled again. This is different from deleting an application and should not automatically be interpreted as evidence that the application was recently used or intentionally concealed.
Parents should also avoid assuming that every unfamiliar application is suspicious. Android phones contain numerous system components and manufacturer-installed applications that may have unfamiliar names but serve legitimate operating system functions. Some applications may also be preinstalled by the manufacturer or installed automatically as part of a software update.
What this breadcrumb can tell you: Application settings can provide a more detailed inventory of applications associated with the current device environment, including certain applications that are disabled or hidden from the ordinary application interface.
What it cannot prove: They do not necessarily reveal applications within separate profiles or protected spaces, establish when an application was last used, or explain what occurred within it.
6/ Battery Usage Can Provide Another Important Breadcrumb
Where to look: Settings → Battery → Battery usage, or the equivalent option available on the device.
Like Apple’s iPhone, Android phones can provide information about which applications have consumed battery power during an available reporting period. Depending on the manufacturer and Android version, battery information may distinguish between foreground and background activity or provide other details about application-related battery consumption.
This can be useful because there is an important difference between discovering that an application is installed and discovering that it has been active. For example, suppose a parent finds an unfamiliar social media application on their child’s Android phone. That discovery alone does not establish that the application has been used. However, if Battery information indicates that the application consumed battery power during a particular reporting period, that provides another piece of information suggesting that the application performed activity.
The distinction between foreground and background activity is important. Foreground activity generally relates to an application being actively presented to the user, while background activity may occur without direct interaction. Applications can perform background tasks for legitimate reasons, including refreshing information, receiving updates, synchronizing information, and maintaining certain connections.
Parents should also understand that Android manufacturers do not all present battery information in the same way. Some devices provide detailed foreground and background activity information, while others primarily display battery consumption by application. Consequently, parents should not assume that every Android phone will provide the same level of detail about how long an application was actively displayed on the screen.
Battery consumption is also not the same thing as time spent using an application. An application that consumes 15 percent of the battery has not necessarily been used for 15 percent of the child’s device time. Different applications consume battery power at different rates, and some can consume substantial power while operating in the background.
Battery information also has limitations. Historical reporting periods vary between devices, and battery records are not designed to function as permanent forensic activity logs. The absence of an application from the available battery information does not necessarily establish that it was never used.
What this breadcrumb can tell you: Battery information can provide evidence that an application consumed power during a reporting period and, on some devices, may help distinguish between foreground and background activity.
What it cannot prove: It does not establish who was using the device, what occurred within the application, or whether background activity involved direct interaction.
7/ Digital Wellbeing Can Provide a Better Picture of Device Activity
Where to look: Settings → Digital Wellbeing & parental controls, or the equivalent Digital Wellbeing dashboard available on the device.
Google’s Digital Wellbeing features are designed to help users better understand and manage their technology use. Depending on the Android version and manufacturer, Digital Wellbeing can provide information about application screen time, device unlocks, notifications, and usage patterns. For parents and caregivers, this information can be useful when trying to understand how a child’s phone is being used.
Rather than focusing exclusively on total screen time, we encourage parents to look at patterns. For example, repeated activity associated with an unfamiliar application may warrant a conversation about what the application is used for and why the child finds it appealing. Similarly, an application showing substantial activity during a particular period may provide useful context when discussing device habits, sleep routines, or family technology expectations.
Digital Wellbeing should not be considered a complete or permanent historical record of everything that has occurred on an Android phone. The information available depends on the manufacturer, Android version, reporting settings, and the period being examined. Applications may also operate within separate user profiles or protected environments, and activity occurring within those environments may not be represented in the ordinary Digital Wellbeing dashboard.
Parents should therefore avoid interpreting the absence of an application from Digital Wellbeing as proof that it was never installed or used. Similarly, there is no universal rule across Android manufacturers establishing exactly what historical Digital Wellbeing information will remain available after an application has been uninstalled.
Another important consideration is that Digital Wellbeing is primarily designed to support healthier technology habits, not to provide parents with a complete investigative record. Although its information may be useful, it should be considered alongside other digital breadcrumbs rather than relied upon as definitive evidence of a child’s online behaviour.
What this breadcrumb can tell you: Digital Wellbeing may provide useful information about reported application activity, notifications, device unlocks, and usage patterns during the available reporting period.
What it cannot prove: It does not necessarily establish a complete history of application use, identify who was operating the device, or explain what occurred within an application.
8/ Check Google Play Store Application History
Where to look: Open Google Play Store → tap the profile icon → Manage apps & device → Manage. Depending on the interface, use the available filter to review applications that are installed or not installed.
An application that has been removed from an Android phone may still be associated with the Google Account used to obtain it. Google Play allows users to review applications associated with their account, including certain applications that are no longer installed on the current device. This can be useful when a parent has a legitimate concern that an application was previously downloaded and subsequently removed.
However, Google Play should not be interpreted as a complete installation history for the phone being examined. An application appearing in the Not installed list may have been obtained on another Android device associated with the same Google Account, while applications installed through other sources, such as Samsung’s Galaxy Store or directly from installation packages, may not appear in Google Play history.
Parents should also understand that applications can be removed from certain Google Play account history lists. Consequently, the absence of an application from the available history does not necessarily establish that it was never obtained or installed.
Another important distinction is that Google Play history is associated with a Google Account rather than a specific device. If multiple Android devices use the same Google Account, the available history may reflect applications associated with those other devices. Similarly, a child may have used a different Google Account to obtain an application, depending on the device’s configuration.
This is why Google Play records are best understood as evidence of an association between an application and a Google Account rather than definitive proof that a particular application was installed or used on the child’s current phone.
What this breadcrumb can tell you: Google Play records may establish that an application was previously associated with a particular Google Account.
What it cannot prove: They do not necessarily establish that the application was installed on the child’s current phone, when it was last used, or whether the child personally downloaded it.
9/ Look at Chrome and Other Browser Histories
Where to look: Open Chrome → three-dot menu → History, or use the equivalent history function in the browser installed on the device.
One of the more common misconceptions about online activity is that a child must have a dedicated application installed to access a particular online service. In reality, many online services can also be accessed through a web browser. Depending on the service and its available features, young people may be able to access social media, video platforms, online communities, and messaging services without installing the corresponding application.
Chrome’s browsing history can sometimes provide useful information about websites that have been visited. However, Google’s Incognito mode generally prevents privately visited pages from being saved in the ordinary Chrome browsing history after the private session ends. Browsing history can also be manually deleted.
Parents should also remember that Chrome is not the only browser available on Android. Samsung Internet, Firefox, Edge, Brave, and other browsers may maintain separate browsing histories and offer their own private-browsing features.
Parents should also understand that Chrome can synchronize browsing information across devices associated with the same Google Account when the relevant synchronization settings are enabled. Consequently, a website appearing in Chrome history does not always establish that it was accessed on the particular Android phone being examined. Similarly, browsing activity conducted through another browser, a separate user profile, or an application-specific browser may not appear in ordinary Chrome history.
Google Account activity settings may provide additional information in some circumstances, but parents should not assume that Google My Activity contains a complete record of everything that occurred in Chrome or other applications. What is recorded depends on the account, activity settings, services used, and other factors.
Even when a website appears in browser history, it does not necessarily establish that the child intentionally searched for it or meaningfully interacted with its content. A website may have been accessed through a link, redirect, or another interaction that requires additional context before conclusions can be drawn.
What this breadcrumb can tell you: Browser history can provide evidence that a browser navigated to or loaded a particular website.
What it cannot prove: It does not establish who accessed the website, why it was accessed, whether the visit was intentional, or what occurred after the page loaded.
10/ Check Deleted Messages, but Understand That Android Varies
Where to look: Open the phone’s messaging application and look for Trash, Recycle Bin, Archived, or equivalent options, if available. The location and availability of these features depend on the messaging application and version being used.
Unlike Apple’s Messages application, Android does not have one universal deleted-message recovery system that operates identically across every manufacturer and messaging application. The available options depend on which messaging application is installed and which version is being used.
On supported Samsung Galaxy devices, Samsung Messages may include a Recycle Bin that temporarily retains deleted conversations. Google Messages has also introduced Trash functionality in supported versions, allowing certain deleted conversations to remain recoverable for a limited period. However, the availability, location, and retention period of these features can vary depending on the application version and rollout status. Parents should therefore open the messaging application and check whether a Trash, Recycle Bin, or similar recovery option is available.
Parents should also distinguish between archived and deleted conversations. Archiving generally removes a conversation from the main message list without deleting it, while deletion may move the conversation into a temporary recovery area or remove it more permanently, depending on the application and its settings.
It is also important to understand that recovering deleted conversations may not be possible in every circumstance. If messages have been permanently deleted, the recovery period has expired, or the application does not support a recovery feature, the messages may no longer be available through the ordinary messaging interface.
This distinction becomes particularly important when dealing with concerns involving cyberbullying, sextortion, threats, grooming, or coercion. However, the presence of a deleted or archived conversation should not automatically be interpreted as evidence of wrongdoing. People routinely delete or archive messages for ordinary reasons, including privacy, organization, or simply because they no longer wish to retain them.
Parents should also understand that third-party messaging applications operate independently. WhatsApp, Snapchat, Instagram, Discord, Telegram, Signal, and other services have their own deletion, retention, synchronization, and recovery systems. A Trash or Recycle Bin feature in the phone’s default messaging application does not provide access to deleted conversations within these other services.
What this breadcrumb can tell you: Depending on the messaging application, archived or recently deleted conversations may remain accessible.
What it cannot prove: It does not establish why a conversation was archived or deleted, who performed the action, or whether inappropriate behaviour occurred.
11/ Check Google Photos, Samsung Gallery, and Trash Folders
Where to look: Open Google Photos or the device’s Gallery application and review the available Archive, Locked Folder, Trash, or Recycle Bin features.
Android phones may use Google Photos, a manufacturer-specific Gallery application, or both. Google Photos includes features such as Locked Folder and Trash, while supported Samsung Gallery versions provide their own privacy and recovery functions. These features can be relevant when parents have a legitimate concern involving screenshots, saved conversations, downloaded images, cyberbullying, intimate-image sharing, or other visual content.
However, the existence of a Locked Folder or private photo collection should not automatically be interpreted as evidence of wrongdoing. These are legitimate privacy features designed to protect sensitive personal information. Parents should also understand that Locked Folder is not the same as Trash. Locked Folder is designed to protect access to certain photographs and videos, while Trash is intended to provide temporary recovery options for deleted content.
Google Photos generally retains backed-up photographs and videos in Trash for up to 60 days, while certain items that were not backed up may remain available for approximately 30 days. However, retention periods and recovery options depend on how the content was stored, whether it was backed up, and the application’s current settings. Parents should not assume that all deleted photographs remain recoverable for the same length of time. Samsung Gallery and other manufacturer-specific applications may also use different recovery periods.
Parents should also understand that Google Photos and a manufacturer’s Gallery application may not display exactly the same content. Images can be stored locally, backed up to cloud services, retained in application-specific folders, or stored within protected environments such as Samsung Secure Folder. Deleting a photograph from one location does not necessarily mean every copy has been removed.
Similarly, finding an image does not establish that the child created it, requested it, or knowingly saved it. This distinction is especially important when dealing with unwanted sexual content or intimate images. A child may have received an image without requesting it and may themselves be the victim of inappropriate conduct.
What this breadcrumb can tell you: Photo applications may reveal images or videos that have been archived, placed in protected collections, or temporarily retained after deletion.
What it cannot prove: They do not establish who created the content, why it was saved or hidden, or whether additional copies exist elsewhere.
12/ Check Notification History
Where to look: On supported devices, open Settings → Notifications → Notification history, or search Settings for “Notification history.”
One Android feature that may be particularly useful is Notification History. On supported devices, Android can retain a limited history of notifications after the feature has been enabled. This can sometimes help parents understand which applications have recently generated notifications, even when those notifications are no longer visible in the ordinary notification panel.
On many supported Android devices, Notification History provides access to notifications from approximately the previous 24 hours, although the exact information and retention period may vary. The feature generally must be enabled before notifications can be retained, meaning it should not be treated as a way to reconstruct notification activity that occurred before it was activated.
Parents should also understand that notifications do not necessarily represent direct communication. Applications can generate alerts for messages, reactions, recommendations, reminders, promotional content, and many other activities. Consequently, discovering numerous notifications from a particular application does not necessarily mean that the child was communicating with multiple people or participating in numerous conversations.
A notification appearing in the history also does not establish that the child opened, read, or responded to it. Similarly, the absence of a notification does not necessarily mean that no communication occurred. Applications may have notifications disabled, conversations may be muted, or the relevant activity may not have generated a visible notification.
What this breadcrumb can tell you: Notification History may provide information about notifications generated by applications during the available reporting period.
What it cannot prove: It does not establish that the child read the notification, responded to it, or participated in a conversation.
13/ Check VPNs, Device Administrators, and Accessibility Permissions
Where to look: Search Android Settings for VPN, Device admin apps, Accessibility, Special app access, or Install unknown apps. The exact locations vary by manufacturer.
Parents and caregivers who are troubleshooting unexpected internet access, filtering problems, or parental-control behaviour may benefit from understanding several Android settings that can affect how applications operate. VPNs can route internet traffic through another network connection and are commonly used for legitimate privacy, security, school, and workplace purposes. However, some VPN configurations can also affect how internet traffic is filtered or monitored. Depending on how parental controls have been configured, certain VPN services may interfere with particular network-based restrictions.
Android also supports device administrator permissions and accessibility services. These capabilities can be used legitimately by security tools, accessibility applications, device management systems, and parental-control services. However, applications granted certain elevated permissions may have additional capabilities that are not available to ordinary applications.
Parents may also wish to review which applications have permission to install unknown applications, display content over other applications, or access sensitive device functions through Accessibility services. These permissions can serve legitimate purposes, but they can also provide applications with capabilities beyond those available through ordinary app permissions. Discovering such permissions should prompt a conversation about what the application does and why it requires them, rather than an immediate assumption that the child is attempting to conceal activity.
Parents should also understand that the presence of a VPN configuration does not necessarily mean that the VPN was active during the period being examined. Similarly, the presence of an accessibility service or device administrator application does not automatically indicate that a child is attempting to bypass parental controls.
Many legitimate applications require these capabilities, and parents should avoid disabling unfamiliar services without first understanding their purpose. Doing so could interfere with accessibility tools, device security features, or legitimate parental-control applications.
What this breadcrumb can tell you: These settings may identify applications with special permissions or configurations that affect device management, accessibility, application installation, or network connections.
What it cannot prove: Their presence does not establish that a child was attempting to bypass parental controls, conceal online activity, or use the device inappropriately.
14/ Understand Google’s Family Link
Where to look: Open the Google Family Link application on the parent’s device, or review the supervised child’s account and device settings where supported.
Google Family Link provides parents and caregivers with tools to supervise certain aspects of a child’s Android device and Google Account. Depending on the child’s age, account configuration, device compatibility, and available features, parents may be able to review certain application activity, establish screen-time limits, manage application permissions, approve or restrict downloads, and configure other safeguards.
However, these capabilities are not identical across every Android device, and the availability of particular controls can change as children become older and eligible for different account-management options. Parents should also understand that Google’s supervision rules and age-related account options can vary by country. Consequently, parents should review the current rules applicable to their child’s Google Account rather than assuming that the same age thresholds and supervision options apply universally.
Family Link is not designed to provide unrestricted access to a child’s private communications. It does not ordinarily allow parents to read the contents of messages, emails, or conversations occurring within third-party applications simply because the child’s account is supervised. Similarly, Family Link should not be considered a complete record of every website visited, application used, or online interaction.
Parents should also understand that Family Link supervision may affect the availability of certain Android privacy features, including Private Space on supported devices. This is one reason why it is important to understand whether the child’s Android device is properly configured for supervision and whether the Google Account being used is the one associated with the family’s parental-control settings.
Here at The White Hatter, we believe Family Link can be a useful tool, particularly for younger children who are still developing the skills needed to manage their online activities independently. However, like every parental-control system, its effectiveness depends on how it is configured, the child’s developmental readiness, and the ongoing conversations taking place within the family.
What this breadcrumb can tell you: Family Link may provide information about certain application activity and parental-control settings on a supervised child’s device.
What it cannot prove: It does not establish everything the child has done online or reveal the content of communications within applications.
15/ Check for Multiple User Profiles
Where to look: On supported Android devices, search Settings for “Multiple users,” “Users,” or “System → Multiple users.” The exact location and availability depend on the manufacturer and Android version.
One Android feature that parents and caregivers may not be familiar with is the ability, on certain devices, to create multiple user profiles. This is different from simply hiding an application or placing information inside a protected folder. When multiple user profiles are supported and enabled, each profile can maintain its own applications, accounts, settings, and personal information.
This means that reviewing the applications, browsing history, or Digital Wellbeing information associated with one user profile may not provide a complete picture of activity occurring within another. For example, an application that does not appear in the main user’s App Drawer may be installed within another user profile, depending on the device’s configuration.
However, multiple-user functionality is not available on every Android phone. Some manufacturers restrict or omit this capability, while others may provide alternative features that serve similar purposes. Supervised devices may also have additional limitations that affect whether separate user profiles can be created or accessed.
Parents should also understand that the existence of another user profile does not necessarily indicate inappropriate activity. Multiple profiles can serve legitimate purposes, including separating personal information between people who share a device or maintaining different environments for different users.
It is also important to distinguish between multiple user profiles and work profiles. A work profile is commonly used to separate employment-related applications and information from personal content, while multiple user profiles generally provide more extensive separation between different users of the same device. Although both features can affect what applications and information are visible, they are not identical.
What this breadcrumb can tell you: The device may have additional user profiles containing separate applications, accounts, and personal information.
What it cannot prove: It does not establish who used another profile, what occurred within it, or whether the profile was created to conceal inappropriate behaviour.
Putting the Digital Breadcrumbs Together
The real value of these different Android features comes from understanding how several pieces of information may support or qualify one another. In digital investigations, this is often referred to as corroboration, which means examining multiple pieces of information to determine whether they support the same general conclusion.
Imagine a parent becomes concerned that a particular social media application was installed, used, and subsequently removed from their child’s Android phone. Looking only at the Home Screen would provide very little useful information because the application is no longer visible. However, a broader review might reveal several different digital breadcrumbs.
Google Play history may indicate that the Google Account previously obtained the application. Digital Wellbeing, if the relevant records remain available, might show activity associated with the application during a particular reporting period. Battery information might independently indicate that the application consumed power during the same general period. The application may no longer appear in the ordinary application list, while Google Play now offers the option to install it again.
Taken together, these observations could provide stronger evidence that the application was previously installed, active, and subsequently removed from the device. However, parents and caregivers should understand that not all of these records will necessarily remain available after an application has been uninstalled. Historical information may be limited, cleared, unavailable, or affected by the device’s operating system, application settings, or user-profile configuration.
One of the most important distinctions parents and caregivers should understand is the difference between evidence that an application was obtained, evidence that it was installed on a particular device, and evidence that it was actively used. These are three different questions, and Android does not provide one universal record that definitively answers all three. Google Play history may establish an association with a Google Account, application settings may establish that an application is currently installed, and Digital Wellbeing or Battery information may provide evidence of activity. However, none of these records necessarily establishes who was operating the device or what occurred within the application.
There is also an additional complication with Android phones. Applications may exist within separate profiles or protected environments, including Private Space, Samsung Secure Folder, or multiple user profiles, depending on the device. Consequently, the absence of an application from the ordinary application list does not necessarily establish that it is absent from every environment on the phone.
Even when several indicators appear to align, they may not establish who was operating the device, why an application was used, what account was accessed, or what occurred within it. This is why we encourage parents and caregivers to distinguish between digital evidence and assumptions about behaviour.
When Safety Is at Risk, Preserve Evidence Before Investigating Further
There is an important difference between reviewing an Android phone as part of ordinary parental oversight and responding to a situation involving suspected criminal activity or serious harm. If a parent or caregiver discovers indicators of sextortion, grooming, threats, online sexual exploitation, coercion, or another potentially criminal incident, we recommend avoiding the immediate deletion of applications, clearing of conversations, resetting of the device, or making unnecessary changes to accounts and settings. These actions can potentially remove information that may later be important to an investigation.
Where appropriate, parents should document relevant usernames, account identifiers, dates, times, messages, and other information that may assist law enforcement or a qualified investigator. However, particular care is required when intimate images involving minors are present. Parents should not unnecessarily download, copy, forward, or distribute suspected child sexual abuse material in an attempt to preserve evidence. Instead, they should seek guidance from law enforcement or an appropriate child protection reporting organization about how to preserve and report the material safely.
Here in Canada, concerns involving online child sexual exploitation can be reported to Cybertip.ca, Canada’s national tipline for reporting the online sexual exploitation of children. Where there is an immediate threat to a child’s safety, parents should contact emergency services.
Parents should also avoid confronting a suspected offender online or attempting to conduct their own investigation by impersonating their child, accessing another person’s account without authorization, or engaging directly with someone suspected of exploitation. These actions can create additional safety concerns and potentially complicate a subsequent investigation.
Most importantly, the child’s immediate safety and emotional well-being should take priority over attempting to conduct a complete investigation of the device. If a child has been threatened, manipulated, coerced, or sexually exploited, the response they receive from a parent or caregiver can have a significant impact on whether they feel safe continuing to disclose what happened.
Our role as parents and caregivers is not to become digital forensic specialists. It is to support our children, preserve relevant information where it is safe and appropriate to do so, and seek qualified assistance when necessary.
Digital Breadcrumbs Should Start Conversations, Not Convictions
This may be the most important part of the entire guide. Discovering a hidden application should not automatically become an accusation of dishonesty. Finding deleted messages should not automatically lead to the conclusion that a child is trying to cover something up. Seeing an unfamiliar website in browsing history should not immediately become evidence that a child deliberately sought out inappropriate content. Those assumptions can quickly turn an opportunity for meaningful communication into an interrogation.
A more constructive approach might begin with something like, “I came across something on your phone that I don’t completely understand. Before I jump to conclusions, I’d like you to help me understand what I’m seeing.” That type of conversation creates an opportunity for the child to provide context, explain their decisions, and potentially disclose something that may have been difficult for them to discuss.
This does not mean parents should ignore legitimate warning signs or avoid setting boundaries. It means that parental oversight is most effective when it is combined with curiosity, education, reasonable expectations, and an understanding of how young people develop judgment and independence. For younger children, more direct supervision and technical restrictions may be appropriate because they are still developing the skills needed to recognize and respond to online risks. As children mature into adolescence, those safeguards should gradually evolve to reflect their growing capabilities, demonstrated responsibility, and need for appropriate privacy.
This is why we encourage families to establish technology agreements before problems occur, rather than introducing device inspections for the first time during a conflict (2). When children understand what their parents may review, why certain safeguards exist, and how those safeguards will change as they demonstrate greater responsibility, parental oversight is less likely to feel arbitrary or punitive.
There will always be circumstances where a parent or caregiver needs to act quickly, particularly when there are credible indicators of immediate harm. However, for everyday parenting, the objective should not be to become the household digital forensic investigator. It should be to combine reasonable oversight with ongoing communication, education, accountability, and gradually increasing independence.
Technology continues to evolve, applications change, and young people will inevitably discover new digital spaces, privacy features, and ways to work around parental restrictions. This is why technical safeguards, although important, can never replace the value of an informed, ongoing, and trusting relationship between parents, caregivers, and their children.
Here at The White Hatter, we often remind parents and caregivers that we should be raising children who are not only safer online today, but who are developing the knowledge, skills, confidence, and judgment to navigate the online world independently tomorrow (3).
No application, parental control, or digital checklist will ever provide parents and caregivers with a complete picture of their child’s online life. Technology can help us identify potential risks, but it is the relationship we build with our children that makes it more likely they will come to us when something goes wrong, rather than feeling they have to hide it.
Digital breadcrumbs can provide information, but they do not necessarily provide understanding. That understanding often begins with a conversation.
Digital Food For Thought
The White Hatter
Facts Not Fear, Facts Not Emotions, Enlighten Not Frighten, Know Tech Not No Tech
Reference:
Sources and Additional Reading
The following official resources provide additional information about Android features, parental controls, application privacy, and digital safety. Because Android manufacturers regularly update their software, readers should consult the documentation applicable to their specific device.
1/ Google Android Help: Private Space
2/ Google Android Help: Digital Wellbeing
3/ Google Play Help: Reinstall and Re-enable Apps
4/ Google Chrome Help: Browse in Incognito Mode
5/ Google Chrome Help: Check or Delete Chrome Browsing History
6/ Google Family Link
7/ Google Family Link Help Centre
8/ Samsung Knox: Secure Folder
9/ Samsung Support Canada
10/ Google Photos Help: Locked Folder
11/ Google Android Help Centre
