Library Device Policy for Laptops, Chromebooks and Hotspots
A library device policy decides who can borrow what, how filtering treats adults and children, and what happens to patron data when a device comes back. The MDM settings come after, and they should follow the policy word for word.
This guide gives you the structure, clauses you can adapt, and the device settings that enforce them.
On this page
- What the policy has to cover
- Adults, minors and the filter
- Clauses you can adapt
- From policy to MDM settings
- Kiosks and self-service stations
- Hotspots
- App categories by device group
- Rollout in five steps
What a library device policy has to cover
Each device type raises the same five questions with different answers. Fill in this grid for your library and most of the policy writes itself.
| Device | Who may use it | Filtering | Privacy and reset | Management tool | Loss and damage |
|---|---|---|---|---|---|
| Public computers and Windows laptops | Cardholders and guests, by session | Your CIPA level, adult disable on request | Patron account removed at sign-out | Microsoft Intune or another device manager | Usually in-building only |
| Chromebooks | Cardholders, in-building or take-home | Filter plus Chrome settings | Managed guest session wipes local data at the end | Google Admin console | Loan agreement terms |
| iPads and tablets | Adults on loan, children in the kids' area | On-device filter, app restrictions by group | Full erase on every return | Your MDM with Apple Business Manager, or Android Enterprise | Loan agreement terms |
| Hotspots | Cardholders, take-home | On the service or by DNS, if at all | Usage data held by the service provider | The provider's portal | Loan agreement terms |
| Self-service kiosks | Anyone in the building | Locked to one app or site | Session timeout between users | Vendor system, or your MDM for iPad and Chromebook kiosks | Fixed in place |
Adults, minors and the filter
Libraries serve adults first and must not over-restrict them. A library that certifies the Children's Internet Protection Act (CIPA) still has room to give adults open access when they ask.
Adult patrons
- Filtering of obscene material and child pornography applies, if you certify CIPA
- An authorized person may disable the filter for an adult's bona fide research or other lawful purpose
- Some libraries use a sign-in step where the adult confirms the purpose
- App controls on adult loan devices protect the device and the next borrower, not the adult's choices
Minors (under 17 for CIPA)
- Material harmful to minors must also be blocked
- The internet safety policy covers minors' safety in chat, email and other direct communication
- The local community, through the library board, decides what else is inappropriate
- Kids' area tablets suit an allowlist; see kids' tablets and early literacy apps
The CIPA duty to monitor minors' online activities sits in the school certification, not the library one.
The US Supreme Court upheld CIPA for public libraries in United States v. American Library Association, with adult disabling part of the picture.
The law that created CIPA states it does not require tracking the internet use of any identifiable minor or adult.
The full set of CIPA rules, including Forms 479 and 486 and record keeping, is in CIPA and mobile devices.
Policy clauses you can adapt
Short clauses in plain words, written for a public library. Change names and numbers to fit; keep each clause to what you will actually enforce.
1Purpose
The library lends and provides devices so that every patron can read, learn, apply for work and reach public services online.
Lead with purpose: it is the clause people read first.
2Who may borrow
Cardholders in good standing may borrow one device of each type at a time. Patrons under 18 need a parent or guardian to sign the loan agreement.
Use your own age threshold; CIPA's "minor" definition (under 17) is about filtering, not lending.
3Filtering
Library devices and networks use a technology protection measure as required by law. Adults may ask staff to disable it for research or other lawful purposes.
4Patron privacy
The library does not keep a record of what patrons read, watch or browse on library devices. Device data is erased when the device is returned or the session ends.
Check this against your state's library records law and your filter's log settings.
5Device management
Library devices are managed remotely. The library may install apps, change settings, locate a device reported lost and erase it at any time.
6Apps on library devices
Devices come with a set of apps chosen by the library. Patrons cannot add apps. Suggestions for new apps are welcome at the desk.
7Children's area devices
Tablets in the children's area run only apps approved by library staff for early learning and reading. A caregiver should stay with children under a set age.
8Hotspots
Hotspots provide internet access for any device the patron connects. Filtering on hotspots, if any, is described in the loan agreement.
9Loss, damage and late returns
Patrons are responsible for devices on loan. Late devices may be locked remotely until returned; fees follow the library's fine schedule.
A remote lock protects patron data on a lost device as much as it protects the library.
10Kiosks and self-service
Self-service stations are for the purpose shown on screen, such as checkout or catalogue search. Sessions end automatically after a short idle period.
11Staff responsibilities
Staff erase and check every returned device before it is lent again, and handle filter disable requests promptly and privately.
Turning the policy into MDM settings
A "library MDM policy" is the policy above, expressed as settings. Here is where each line lives for the platforms libraries use most.
| Policy line | Microsoft Intune | Google Admin console | iPad MDM and Apple Business Manager |
|---|---|---|---|
| Data erased after each user | Shared device settings for Windows that remove patron accounts after sign-out | Managed guest sessions, which wipe local data when the session ends | Erase with Return to Service on return |
| Patrons cannot add apps | App restrictions per platform; App Store off on supervised iPads | Play Store: Block all apps, admin manages allowlist | App Store off, apps assigned to the device |
| Kids' devices run approved apps only | Android dedicated devices in kiosk mode; iPad allowlist | Separate organizational unit with an allowlist | Allowlist restriction on supervised iPads |
| Teen devices block adult categories | Restricted apps list from a category file | Android app blocks from a category file | Blocklist profile from a category file |
| Device stays managed after a reset | Automatic enrollment for Windows and Apple devices | Forced re-enrollment | Automated Device Enrollment through Apple Business Manager |
| Kiosks stay on one task | Kiosk profiles for Windows, iPad and Android | Kiosks with Auto-launch app | Single App Mode |
Step-by-step guides: blocking apps in Intune and blocking apps in Google Admin. Labels change between versions, so confirm names in your current console.
Kiosks and self-service stations
"Library kiosk" covers two very different things: self-checkout machines, and ordinary iPads or Chromebooks locked to one job. Your policy should name both.
Self-checkout and book kiosks
Vendor systems connected to your circulation system. Installation, features, user guides and cost come from the vendor; the policy covers use and privacy.
Chromebook kiosk mode
Devices > Chrome > Apps & extensions > Kiosks, then Auto-launch app. Kiosk settings include status alerts by email or text message and power actions on idle.
iPad kiosk mode
Single App Mode from the MDM, with auto lock blocked. Details in Single App Mode and Guided Access.
Video call station
A Chromebook in a managed guest session with the meeting web app force-installed suits job interviews and telehealth. Data is wiped when the session ends.
Kiosk background and screen saver
Managed guest sessions can show screen saver images from your own URLs, so a station looks like the library's and shows opening hours when idle.
Kiosk login
If patrons sign in to their account on a kiosk, set a short idle timeout and end the session automatically, so the next person never sees it.
Accessibility: Chromebook kiosk settings include a floating accessibility menu option and pinch-to-zoom. Turn them on for public kiosks so patrons with low vision can use them.
Hotspots: what the policy can and cannot promise
A hotspot is a connection, not a device you can install apps on. The policy should say plainly how it is filtered, if at all, and what data the service provider keeps.
Filtering
App blocklists do not apply. Filtering happens on the hotspot's service or through a DNS filter set on the hotspot, where the service allows it.
Funding rules
E-rate support for lending hotspots has changed more than once in recent years. Check current eligibility before you rely on it, and how CIPA applies if it funds the service.
Data held elsewhere
The service provider sees connection data. Tell patrons in the agreement, and keep the library's own records to the loan itself.
Paired devices
A hotspot loaned with a library Chromebook or iPad gets that device's filtering and app rules. A patron's own device on the hotspot does not; see bring-your-own-device app policy.
Reset and privacy, device by device
The privacy clause only holds if every device type has a reset that actually runs. This table pairs each device with what to wipe, how and when.
| Device | What must go | How | When |
|---|---|---|---|
| Public Windows computer | Patron account, downloads, browser data | Shared device settings that delete the account at sign-out | Every sign-out |
| Chromebook, in-building | All local user data | Managed guest session with a maximum session length and idle sign-out | Every session end |
| Chromebook, take-home | Everything from the loan | Managed guest session sign-out, or a wipe with Forced re-enrollment | On return |
| iPad, take-home | Apps' data, sign-ins, photos, history | MDM erase with Return to Service | On return |
| iPad, kids' area | Drawings, recordings, app progress | Scheduled erase, or Shared iPad temporary sessions | Daily |
| Android tablet | Everything from the loan | MDM wipe, then re-enrollment as a fully managed device | On return |
| Hotspot | Nothing on the device; the provider holds connection data | State the provider's role in the agreement | At check-out |
Patrons' own devices on library Wi-Fi
Many patrons bring their own phone or laptop. The library does not manage those devices, so the policy covers the network, not the device.
Network filter only
Your network filter applies to traffic on library Wi-Fi. App blocklists cannot reach a device the library does not manage.
Terms on the splash page
A short acceptable use notice on the Wi-Fi sign-in page tells patrons the network is filtered and how adults ask for access.
No device inspection
Staff do not install software on patrons' devices or ask to inspect them. Help with settings stays at the patron's request.
Children's devices
Parents manage their children's own devices. Staff can point them to the device's built-in parental settings.
Staff training checklist
A policy is only as good as the desk that applies it. Cover these points with every staff member who lends devices.
At check-out and return
- How to read the loan agreement aloud, privacy note included
- How to start an erase and confirm it finished
- What a device ready for the shelf looks like
- When to pass a device to IT
At the help desk
- How to handle an adult's request to lift the filter, quickly and privately
- What to say when a patron asks what the library can see
- How to log an app request for the next review
- Where the written policy is, for patrons who ask
App categories by device group
Category lists turn a policy line such as "teen devices block adult content" into a file the MDM can apply. This is a starting point; your board sets the final choices.
| Category | Kids' area | Teen loan | Adult loan | Staff |
|---|---|---|---|---|
| Adult | Block | Block | Filter level | Block |
| Dating | Block | Block | Allow | Choice |
| Gambling | Block | Block | Allow | Block |
| VPN / Proxy / Anonymizers | Block | Block | Choice | Choice |
| Social Networking | Block | Choice | Allow | Allow |
| Email and Messaging | Block | Choice | Allow | Allow |
| Gaming | Allowlist only | Choice | Allow | Choice |
| Streaming Media | Allowlist only | Allow | Allow | Allow |
| Remote Access Tools | Block | Block | Choice | Choice |
| AI / LLM Tools | Block | Choice | Allow | Choice |
| Malware / Phishing / Suspicious | Block | Block | Block | Block |
| Apps rated 17+ as listed in the App Store | Block | Block | Allow | Choice |
See what a category includes on the social media apps list or VPN app blocking, and check any single app with the app category lookup.
Rollout in five steps
Most of the work is agreeing the policy. Configuring devices takes days once the policy is settled.
- Step 1
Draft
Fill in the device grid and adapt the clauses with branch and IT staff.
- Step 2
Adopt
Take it to the board. If it changes your CIPA internet safety policy, follow your notice and meeting rules.
- Step 3
Configure
Create MDM groups per device type and audience, then apply the category files to each.
- Step 4
Pilot
Lend devices to staff first. Fix what breaks before patrons see it.
- Step 5
Review
Revisit once a year, and whenever a new device type joins the collection.
For the day-to-day running of a tablet collection, from check-out to erase, see library tablet and iPad lending.
Library device policy questions
Does a library have to filter adult patrons?
A library that certifies CIPA filters obscene material and child pornography for everyone, but an authorized person may disable the filter for an adult's bona fide research or other lawful purpose.
Do libraries have to monitor what patrons do online?
No. The CIPA duty to monitor minors' online activities is in the school certification, not the library one.
Can app blocklists filter a lending hotspot?
No. A hotspot carries traffic for any device that connects. Filtering, if needed, happens on the service or through a DNS filter.
Can Intune manage library devices?
Yes: Windows laptops, iPads and Android tablets. Shared device settings remove patron accounts on Windows; app restrictions and kiosk modes cover tablets.
Should the policy cover staff devices?
Yes, in a short section of its own. Staff devices sit in their own MDM group with a lighter profile, and staff should know which rules apply to them and which only to patron devices.
How often should a library device policy be reviewed?
Once a year, and whenever a new device type joins the collection or a filtering rule changes. Category lists update monthly, so the policy itself rarely needs to name individual apps.
Can a late device be locked remotely?
Yes, if your MDM supports it and the loan agreement says so. A lock also protects the patron's data on a device that may be lost.
What is a library self-service kiosk?
Usually self-checkout or a catalogue station. Self-checkout machines are vendor systems; an iPad or Chromebook kiosk is managed like any other library device, locked to one app.
Category files for every device group
Kids', teen and staff profiles from one set of category lists, for iPads, Android tablets and Chromebook Android apps, updated monthly. One plan covers one library.
Microsoft Intune and Windows are trademarks of Microsoft Corporation. Chromebook, Chrome and Google Admin are trademarks of Google LLC. iPad and Apple Business Manager are trademarks of Apple Inc. Android is a trademark of Google LLC.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies. This page is general guidance, not legal advice.