Parental controls

Three separate controls that do three different jobs:

Control	Stops
A rating cap on a profile	That profile seeing anything above the rating you set
A PIN on a profile	Anyone else opening it, including to get around their own cap
The admin PIN	Anyone walking into the server settings and undoing the other two

All three are set in Settings → Users and Profiles, and all three are enforced by the server, not by the app.

Above the cap means gone

This is the part that matters, so it is worth being clear about.

A capped profile does not see the 18s behind a padlock for a curious ten-year-old to poke at. The server never sends them. They are not in any row, not in search, not in a collection, not in the guide, not reachable by typing an address into a browser, and not reachable through the API. The title simply does not exist for that profile.

That is true on every app equally, because the filtering happens in one place rather than being reimplemented six times.

Setting a cap

Open a profile and use Lock and limits. Four presets:

Preset	Roughly
Little kids	U, G, TV-Y
Older kids	PG and equivalents
Teens	12A, PG-13, TV-14
Mature	No cap at all

Or pick an exact rating from a slider showing your country’s ladder, so you set 15 in the UK and R in the US rather than translating in your head.

Underneath is one toggle: Allow unrated items. Home videos, a lot of live TV, and files that never matched anything have no certification at all. The kid presets turn it off. On a custom cap it is your call.

How ratings from other countries are handled

Every title carries the certifications from every country that rated it. When your own country’s board rated a film, that is what is used. When they did not, the most restrictive rating any country gave it is used instead.

That is deliberately cautious, and it means a film certified only in Germany still gates properly in a British home. When it gets something wrong, override that one title rather than loosening the whole cap.

Overriding one title

As the owner, open any film or show and use the ⚑ Rating limit option:

• Always allow for capped profiles
• Always block for capped profiles
• A rating of your choosing, which then behaves like any other rating

That covers home videos, mapping disagreements, and the film your country rated absurdly.

Profile PINs

A cap on a child’s profile is a suggestion if they can just pick your profile instead. So once you cap one profile, put a PIN on the uncapped ones. The server will tell you the same thing.

Set one from Lock and limits → Set PIN. Four to six digits.

• A locked profile cannot be opened, on any device, without the PIN.
• After five wrong attempts there is a cooldown that doubles if someone keeps trying, and you get a notice saying which device it was.
• On a phone or tablet, after you have entered the PIN once you can turn on Face ID or a fingerprint instead.
• Forgotten it? As the owner you can clear or change any profile’s PIN from Users and Profiles. Nobody has to reset anything.

Children’s profiles usually stay open. The cap does the limiting; the lock protects the unrestricted profiles.

PINs on a TV, without showing the room your PIN

Typing a PIN on a TV is a problem: the on-screen keypad highlights each digit as you move to it, and everyone on the sofa can read it. Every streaming service ships that, and complains about it.

Two answers, both offered on the unlock screen:

Unlock from your phone, which is the one to use. The TV asks, a prompt appears on the phones signed into your account, you approve with Face ID or a fingerprint, and the TV unlocks. Nothing about the PIN appears on the shared screen. You do not have to walk over, and you do not have to type it in front of anyone.

If your phone was in your pocket and you open the app a few seconds after the TV asked, the request is still waiting for you. It lives for two minutes.

A scrambled keypad, as the always-available fallback. The digits are laid out in a random order, reshuffled on every attempt, so watching someone’s thumb move tells you nothing. Where a remote has real number keys, those always work too, which leaks nothing at all.

When a screen reader is switched on, the keypad goes back to a normal order, because a screen reader reading out scrambled key positions aloud is worse than anything it was protecting against.

Locking the server settings

A limit that whoever picks up the remote can quietly remove is not a limit. So there is an admin PIN on the door into the server settings.

• Set it in Users and Profiles → Require PIN for server settings. It arms itself automatically the first time you set any profile PIN or rating cap, because a cap without it is decorative.
• It is asked for once, when you open the settings hub, and not again. Ordinary things you do around the app do not prompt you.
• If your server is linked to an account, your account password is always accepted instead, which is also the way back in if you forget the PIN.
• If your server is not linked and you have forgotten the PIN, run multipass admin-reset on the server itself.

The admin PIN and a PIN on your own profile are two locks on two different doors, deliberately. One stops people watching as you; the other stops people changing the rules.

What the caps also cover

Not just browsing:

• Playback is blocked at the server, so a direct link to a file goes nowhere.
• Downloads of an above-cap title are refused.
• Movie Night will not let a capped profile add an above-cap title to the queue.
• Live TV and recordings need “allow unrated” to be on, because a live channel has no certification.

What is not here yet

Stated plainly rather than left to be discovered:

• Per-programme live TV ratings. Live channels are all-or-nothing today, via the unrated toggle, rather than gating individual programmes from the guide.
• Time windows, as in “no watching after 9pm”.
• A simplified kid interface. A capped profile gets the normal app, with less in it.