Work / 01 · 2014–2022

Building Google's parental controls from zero

Family Link is how hundreds of millions of parents help their kids navigate technology — set screen-time limits, approve apps, see location, manage a real Google account. I founded its engineering and led it from the first prototype to 200M+ people across 140+ countries, and into the platform 80+ Google products build on.

200M+

people on Family Link

80+

Google products it connects to

140+

countries, each with its own rules

0→1

founding engineer to org leader

The stakes

Kids used every Google product. The systems pretended they didn't exist.

By 2014, parents were worried about how much time their kids spent on devices, and regulators were preparing to ask Google pointed questions about children. The company had no real answer: no way for a parent to set up and oversee a child's account, no consent model under COPPA, no controls families could lean on. Every product guessed. It was a regulatory risk, a brand risk, and above all a missed responsibility to a billion-person audience.

I joined Kids & Families as a founding engineer when it was a set of parallel experiments, and helped pick the winners: family identity, supervision, location. When the company converged them into one product — the flagship of a three-year, 300+ engineer program spanning Google — I owned the launch engineering end to end. Family Link shipped in 2017, the first time children under 13 could have Google accounts, with parents verified and consenting at every step. I grew with it, from single-threaded owner to leading the engineering organization behind a global platform.

The bet

One model for the whole family

The original system treated “child account” as a special type — created through our flows, supervised from birth. Real families broke that model immediately: a thirteen-year-old with three years of email and photos doesn't want a new account, and forcing one destroys the very thing that makes supervision worth accepting.

The bet I drove: generalize. Any account in a family can hold a supervision relationship— explicit, time-bounded, reversible — recorded in Google's central account systems and honored everywhere. Products stopped asking “is this a child?” and started asking what the family's trust grant allows. One policy engine answered for every surface, with region-specific behavior for the EU, Japan, Korea, and beyond.

Consent became something the architecture enforced, not something the UI promised.

That one decision changed how the whole company served families: 80+ products supported supervised kids without reinventing it, new regulation became configuration instead of a rewrite, and when the law changed — GDPR, regional youth-privacy rules — there was one place to answer from. It reframed the roadmap from “a kids app” to “the family layer of Google” — and it's the reframe I'm proudest of.

Consent, by design

Supervision you cannot impose — only ask for

The most sensitive call was attaching supervision to a teen's existing account. Done carelessly, that's a stalkerware primitive — and we said so out loud, then designed against it. The parent–teen handshake enforced invariants no amount of product pressure could override:

Parentmakes the request

asks

On the teen’s own deviceExplicit yes?never silent, never the parent alone

yes

Supervisedreversible · audited

No explicit yes → the account is untouched

Fig. 01 — The parent–teen consent handshake

stateconsent

Their device, their yes: Supervision activates only through a positive action on the teen's own device — never silently, never by a parent alone.
Legible terms: Before accepting, the teen sees which parent is asking, exactly what supervision enables, and how to end it later.
No silent escapes: Every device the account touches either enforces the policy or is explicitly marked an exception — no ambiguous middle.
Reversible by design: Ending supervision is a first-class flow that returns every device to a consistent state, with both sides notified.

We brought years-old accounts, live on many devices, under supervision without wiping or recreating anything — changing the locks while people lived in the house. The program spanned 8 product areas and 20 launch components, with 14+ engineers in three subteams; the core shipped in about seven months against 12–18 month estimates, and supervised usage grew roughly tenfold with no large-scale data-loss or lockout incidents. Privacy, policy, and legal reviewers approved it because the architecture made coercion structurally hard, down to audit records that capture the exact words shown at the moment of consent. The same consent infrastructure became how Google met GDPR's requirements for children's accounts.

Humans in the loop

Automated enforcement, human judgment

Family accounts generate the hardest cases a consumer company sees: custody disputes, a deceased parent, a teen in an unsafe home. Pure automation fails these people; pure manual review doesn't scale to hundreds of millions. We built the middle: automated policy enforcement with reviewable workflows, full audit trails, and escalation paths that let support, policy, and product teams resolve sensitive parent–child issues with context and authority.

Automate the routine. Escalate the sensitive. Audit everything.

We were also honest about our adversary: a supervised kid is the most motivated red team on earth. Enforcement had to survive password resets and token revocations, and rules had to be updatable in hours when a bypass surfaced. One override outranked every control we built — emergency calls always work.

Code Red

Pausing the roadmap to keep the promise

By 2019, growth had outrun early assumptions. Ratings slid, call centers flooded, and parents began doubting the basics — fatal for a product whose entire value is dependability. I turned scattered complaints into a failure map the organization couldn't argue with, then made the case to executives — many of them Family Link parents — that reliability was existential and headline features had to wait.

Three quarters, a ~25-person cross-site team, and a new operating culture later — SLOs, postmortems, on-duty rotations holding 50+ triaged issues a week, the overdue-P1 backlog cut from 34 to 7 — support complaints had fallen roughly 70% even as the user base grew about 500%. The Play Store rating climbed from 4.1 to 4.3, and the stable foundation carried the platform past 200 million users.

Shipped in public

The launch record, on the record

Eight years of this work shipped in public. A selection, each linked to official coverage:

Outcome

A product families trust — and the way I work, proven

Family Link became Google's platform for youth and family experiences, a reference point competitors answered to, and a product parents genuinely rely on. I led its engineering from founding prototype through a 25+ person organization inside a 90-person cross-functional effort.

Reliability: Support complaints down ~70% while users grew ~500%; Play Store rating from 4.1 to 4.3 through the program I led.
Delivery: Existing-account supervision shipped across 8 product areas in ~7 months against 12–18 month estimates; 140+ production releases under my release gating.
Responsibility: The consent model became how Google met GDPR for children's accounts. Privacy reviewer for 25+ launches; no server-side location history for child accounts, by design.
Engineering culture: SLOs, postmortems, and on-duty triage adopted across ~90 engineers; ~150 projects flowed through development processes I set up.

What I took from it: start from the people you serve and the moments that matter most to them, then make the technology meet that bar — even when it's the slower, harder path. It's the instinct I bring to every product since.

Next — 02 · 2022–2024

Leading Google's Assistant into the Gemini era