App Stores Outside Google Play: What Family Link Actually Controls

Sideloaded stores install differently

Google Play is part of the system and may install software by default. Any other store arrives as an APK file from a website, and Android treats that as installation from an outside source. Since Android 8.0 the permission is granted per app: separately for the browser, for Files, for a messenger — whichever one opens the file.

The switch lives in Settings → Security (or Apps) → Special access → Install unknown apps, where you pick the app and turn on “Allow from this source”.

A second permission goes to the store itself, or it will not be able to install anything from its own catalogue. Parents grant the first and forget the second all the time, and then the store opens while downloads quietly stall.

None of this exists on iPhone. APK files do not run on iOS, so a store that ships as an APK simply has no iOS version, and anything claiming otherwise in the App Store is not the real thing.

What Family Link genuinely controls

Worth reading straight from Google’s documentation, because guesswork dominates this topic.

Download approval sits in Google Play settings → Purchase and download approvals → What needs approval, with four options: all content, paid content only, in-app purchases only, or never. When the child tries to install something, they either send you a request or you type your own account password on their device.

Then comes Google’s own caveat: these settings “apply only to purchases made using Google Play’s payment system”. The approval lever was never designed for an APK pulled from a browser.

The second lever blocks individual apps with an Allowed / Blocked switch: it works on what is already installed and takes effect within five minutes. The third is the age rating filter inside Google Play.

Some store vendors claim supervision forbids installing from unknown sources outright. We could not find a Google page saying that, so treat it as the vendor’s description rather than documented Android behaviour, and verify on your own device.

Why updates quietly stop

Three separate causes here, and people routinely mistake them for one.

The first is documented by Google and lives inside Google Play: if a new version of an app carries a different age rating that no longer passes your filter, the update is simply never offered. Change the restriction, or lift it, update, and put it back.

The second belongs to the store: to update apps silently it needs install permission, background activity and notifications. Revoke any one of those and it will either ask for confirmation every time or say nothing at all.

The third has nothing to do with parental controls. An app installed from Google Play and updated from another store fails on a signature mismatch, because the two builds are signed with different keys. Update where you installed from.

A store’s own kids mode

Most alternative stores now ship a kids mode, and few parents ever open it. The pattern is the same: a profile section, an age band, a PIN, and an email for recovery.

Age bands typically map to rating tiers (preschool, primary school, teens, or no limit), and the chosen band changes what appears in listings and search, and what may be installed or updated.

With the PIN set, a child cannot install something above their band even from a direct link, and cannot buy items inside a game. Repeated wrong PIN attempts lock the prompt for an hour.

That covers the shop window. How long your child then spends inside the installed game, and when it may open at all, is a different layer, covered by schedules and time limits on the device itself.

Phones without Google services

On handsets released after 2019 by manufacturers cut off from Google services, there is no Play Store at all, and sideloading is the normal way to install anything.

Paths differ by shell. On EMUI: Settings → Security → Install apps → pick the browser → allow unknown sources. On HarmonyOS: Settings → Privacy → Additional settings → Install apps from external sources.

Family Link cannot help on those devices, because it depends on Google services. What a parent is left with there is covered in the piece on parental controls for Huawei.

Lookalike download sites

Sideloading trains people to download installers from websites, and that is exactly what fake sites exploit. Vendors publish lists of the impostor domains they know about, usually near-identical spellings of the real one, and at least one full clone hosting a malicious file.

Check the certificate behind the padlock in the address bar: it names the company that owns the store. A domain that merely looks right proves nothing.

This is worth explaining to the child directly. They search for the store by name and open the first link, and the first link is not always the official site.

Agreeing beats forbidding

If the app your child wants genuinely lives outside Google Play, install the store together, switch its kids mode on with a PIN, and explain what the PIN is for. A silent ban performs badly here: an APK can be found on any site, and you would be the last to know.

After that it is ordinary work: knowing what is installed and keeping the hours sane. New installations show up in reports, and what those reports contain is worth a look before you need it.