CIPA and Mobile Devices: iPads, Phones and Take-Home Devices
The Children's Internet Protection Act (CIPA) was written when "computer" meant a desktop in a lab. Today the computers are iPads on carts, Chromebooks in backpacks and phones in pockets.
This page sets out what the law actually asks of a school, how it lands on each kind of device, and where app controls help.
CIPA in one paragraph
Schools and libraries that receive E-rate discounts for internet access or internal connections must certify that they enforce an internet safety policy, including a technology protection measure that blocks or filters certain visual depictions.
CIPA took effect on April 20, 2001. Your E-rate adviser and counsel have the final word on your situation.What CIPA requires, in three parts
Every CIPA conversation comes back to these three requirements. None of them names a device type, an app or a brand of filter.
Internet safety policy
A written policy, adopted and enforced, that includes a technology protection measure for both adults and minors.
Technology protection measure
A specific technology that blocks or filters internet access, enforced on computers with internet access.
- Covers certain visual depictions
- Can be disabled for adults in defined cases
Public notice and hearing
Reasonable public notice and at least one public hearing or meeting on the proposed policy. Private schools notify their own constituent group.
What the filter must block
The technology protection measure covers three kinds of visual depictions. Two apply to everyone; one applies to minors only. For CIPA, a minor is anyone under 17.
| Content | Adults | Minors (under 17) | Where the definition comes from |
|---|---|---|---|
| Obscene visual depictions | Must block | Must block | Federal criminal law |
| Child pornography | Must block | Must block | Federal criminal law |
| Material harmful to minors | Not required | Must block | A three-part test in the law, below |
Part 1
Taken as a whole and with respect to minors, it appeals to a prurient interest in nudity, sex or excretion.
Part 2
It depicts sexual acts, sexual contact or lewd exhibition in a way that is patently offensive for minors.
Part 3
Taken as a whole, it lacks serious literary, artistic, political or scientific value for minors.
Beyond these three, the local community decides what is inappropriate for minors, typically through the school board. That is where blocks on games, social media or AI chat come from: local policy, not CIPA itself.
Five topics the internet safety policy must address
The policy has to cover these five areas. The right-hand column shows where app controls on mobile devices support each one.
| Policy topic | Where app controls help |
|---|---|
| Access by minors to inappropriate matter on the internet | Block Adult, Gambling and Dating apps, and apps rated 17+ as listed in the App Store, so content does not arrive through an app instead of the browser. |
| Safety and security of minors in email, chat rooms and other direct electronic communications | Decide which chat and messaging apps are allowed; block anonymous chat and random video chat apps by category. |
| Unauthorized access, including hacking, and other unlawful activities by minors | Block Remote Access Tools and VPN / Proxy / Anonymizers apps, and stop students creating VPN configurations. |
| Unauthorized disclosure, use and dissemination of minors' personal information | Review apps that collect or share data before approval; see apps that share data. |
| Measures restricting minors' access to materials harmful to minors | The filter is the measure. App controls stop the routes around it: other browsers, VPNs and apps with built-in browsers. |
Certification: Form 486 and Form 479
Certification is done by the Administrative Authority: for schools, the school, board, district or other responsible authority; for libraries, the library, its board or other responsible authority.
Administrative Authority
Certifies that the internet safety policy and technology protection measure are in place.
If it is also the Billed Entity
It certifies directly on FCC Form 486.
If it is not
It completes FCC Form 479 for the Billed Entity, which certifies on Form 486 that it collected the 479s.
The entity may certify that it is undertaking actions to comply, and keep proof of those actions for audit.
It must certify compliance, unless state or local procurement rules prevent it, in which case a waiver can be requested.
It must be compliant. No more undertaking-actions certification.
Three certifications are possible: compliance is complete, actions are under way, or CIPA does not apply because the entity receives discounts only for telecommunications services. Telecommunications-only Billed Entities do not need to collect Form 479.
Does CIPA apply to iPads, Chromebooks and phones?
CIPA speaks of computers with internet access and ties the duty to E-rate funded services. Treat iPads, Chromebooks and laptops alike. The harder questions are about where the device is and who manages it.
School iPad on school Wi-Fi
A school computer with internet access on a funded network. The technology protection measure must cover it, and app controls should back it up.
School iPad or Chromebook at home
Whether the duty reaches a device on home internet depends on how the device and connection are funded. A filter on the device itself covers both cases, so protection travels with it.
Student's own phone on school Wi-Fi
Traffic over the school network passes your network filter. You cannot install restrictions on a device you do not manage.
Student's own phone on cellular data
Neither your network nor your management touches it. This is where phone policies and state phone laws come in, not CIPA.
Hotspots lent to students
E-rate support for off-campus hotspots has changed more than once in recent years. If a federal program funds the hotspot or its service, ask your adviser how CIPA applies.
Library tablets for patrons
Libraries certify too. An authorized person may disable the filter for an adult's bona fide research or other lawful purpose. See our library device policy guide.
For the take-home side in detail, including after-hours rules and home Wi-Fi, see take-home device restrictions.
E-rate and iPads
Searches for "E-rate iPad Pro" or "E-rate iPad Air" usually come from someone hoping the tablets are discounted. The program works differently.
What E-rate discounts
Services: Category One internet access, and Category Two internal connections, managed internal broadband and basic maintenance of internal connections.
What it does not
End-user devices such as tablets and laptops are not on the eligible services list. Check the current list each funding year before you plan.
Why it still matters
The CIPA certification you make for those services covers the school's computers with internet access, and that includes the iPads using the network.
Where app blocking fits next to the filter
On a mobile device, protection works in layers. The filter is the technology protection measure. The other layers stop students and apps from going around it.
Be precise in your documentation: app blocking alone does not make a school CIPA compliant. It supports the filter. Describe it in your records as part of how the technology protection measure is enforced on mobile devices.
Gaps a web filter alone can leave on mobile devices
| Gap | Why it matters | App-side control |
|---|---|---|
| VPN and proxy apps | They tunnel traffic past a network filter. | Block the VPN / Proxy / Anonymizers category; on supervised iPads, limit VPN creation to managed apps. See blocking VPN apps. |
| Other browsers | Some filters need extra set-up per browser, and some browsers route traffic through their own servers. | Allow one browser and block the rest; see blocking other browsers. |
| Cellular iPads | Traffic never touches the school network filter. | On-device filter plus app controls that do not depend on the network. |
| Chat and messaging apps | Images and links arrive inside the app, not through a browser. | Approve a short list of school messaging tools; block the Email and Messaging category for younger students. |
| Remote access tools | A student can drive an unfiltered computer elsewhere. | Block the Remote Access Tools category. |
| AI chat and image apps | They generate content that no address-based filter has seen before. | Decide under your AI policy; see AI apps on student devices. |
"CIPA compliant apps": what the phrase really means
There is no official list of CIPA compliant apps, and no certification for them. CIPA places duties on schools and libraries, not on app makers. Here is what the common searches are really asking.
CIPA compliant apps on iPhone and iPadIs an app allowed?
An app is neither compliant nor non-compliant. What counts is whether your measures cover the device it runs on.
CIPA compliant apps in IntuneCan Intune do it?
Microsoft Intune deploys your filter, restrictions and app blocklists to iPads, Android and Windows. The filter is still the measure.
CIPA and YouTubeVideo is visual content
Use YouTube's restricted access levels for school accounts, and decide whether the app is allowed at all on each device group.
CIPA and ZoomLive video meetings
Video meetings are direct electronic communications, a topic your policy must cover. Set meeting rules in policy and in the meeting service's admin settings.
CIPA and GoogleChromebooks and Workspace
The Google Admin console holds app, extension and YouTube settings for Chromebooks. Your filter still has to cover browsing.
CIPA compliant apps for WindowsLaptops in schools
The same layers apply: a filter that covers every browser, plus app controls through your management tool.
CIPA XMLConfiguration files
Admins often mean a configuration profile. Our .mobileconfig blocklists are XML property list files; see .mobileconfig blocking.
"Not working"Filter gaps on iPads
Check supervision, VPN apps, cellular data, other browsers and whether the profile is still installed. These cause most mobile filtering failures.
Phones are a separate question
Phone bans and CIPA often get mixed up. They come from different laws, cover different devices and are enforced in different ways.
| CIPA | State phone laws and district phone policies | |
|---|---|---|
| What it governs | Filtering of internet access on school and library computers | Whether students may use personal phones during the school day |
| Who it applies to | Schools and libraries receiving E-rate discounts for internet access or internal connections | Public schools in the state, or the district that adopts the policy |
| How it is enforced | Certification on Forms 486 and 479, audits, E-rate funding | State law and school discipline policy |
| Device type | Any school computer with internet access | Personal phones and sometimes smartwatches |
For the state-by-state picture, see school phone ban laws. For device rules students sign, see the student device acceptable use policy guide.
Records to keep for an audit
The Universal Service Administrative Company (USAC) lists the documents to retain. Keep them for at least 10 years after the later of the funding year's last day or the service delivery deadline.
- A copy of the internet safety policy
- Evidence of public notice, and of the public hearing or meeting, with dates
- Evidence the policy was adopted, such as board minutes
- A description of the filter, including how it covers mobile devices
- Reports showing the filter was installed and working during the funding year
- Copies of FCC Forms 479 and 486, as applicable
- Your mobile app controls: which categories, which device groups, how often lists update
- For a first funding year, proof of actions taken, such as filter quotes or draft policies
Adults, staff and turning the filter off
CIPA covers adults too, but only for obscene material and child pornography. It also allows an authorized administrator or supervisor to disable the measure for an adult's bona fide research or other lawful purpose.
Staff devices
Staff need a lighter app profile than students. Block the risky categories (VPN, remote access, gambling) and let teaching tools through.
Adult patrons
Libraries must not over-restrict adults. Some use a sign-in page where the adult affirms the purpose before the filter is lifted.
Separate device groups
Keep student, staff and patron devices in different MDM groups so each gets the right profile without exceptions on one device.
Monitoring on mobile devices: what CIPA asks
Schools must monitor the online activities of minors. Libraries have no such monitoring duty in their certification. The law that created CIPA also states that nothing in it requires tracking the internet use of any identifiable minor or adult.
Monitoring minors online
Supervision of how students use the internet, set out in your policy. Teacher supervision, filter reports and classroom tools can all play a part.
Tracking each student
CIPA does not require a record of every site each named student visits. If you keep one, it is a local choice with its own privacy duties.
App inventory reports
Your MDM's installed-apps report shows what is on each device. Comparing it monthly with category lists is device management, not tracking of browsing.
A mobile CIPA review before each school year
Run this list each summer, before devices go back out. It keeps the mobile side of your documentation matched to what is really on the devices.
- Confirm every student iPad is supervised and every Chromebook is enrolled
- Check the on-device filter is installed on take-home and cellular devices
- Refresh app blocklists: VPN, remote access, browsers, chat, adult, gambling, dating
- Re-check which apps are approved and drop the ones no class uses
- Test from a student account: other browsers, VPN apps, guest modes
- Update the filter description in your records to match the current set-up
- Confirm the policy still covers the five required topics
- File the year's filter reports with your CIPA records
CIPA questions from school IT
Is there an official list of CIPA compliant apps?
No. CIPA places duties on schools and libraries, not on app makers. A product described as CIPA compliant is one its vendor says can help meet the technology protection measure requirement.
Does blocking apps make a school CIPA compliant?
No. CIPA needs an internet safety policy, a technology protection measure and a public notice and hearing. App blocking supports the filter but replaces none of these.
Who counts as a minor under CIPA?
Anyone under 17.
Does E-rate pay for iPads?
E-rate discounts services such as internet access and internal connections. End-user devices are not on the eligible services list; check the current list.
Can the filter be turned off for adults?
Yes. An authorized administrator or supervisor may disable it for an adult's bona fide research or other lawful purpose.
Does CIPA require tracking what each student does online?
No. Schools must monitor the online activities of minors, but the law states that nothing in it requires tracking the internet use of any identifiable minor or adult.
How long must CIPA records be kept?
At least 10 years after the later of the last day of the funding year or the service delivery deadline for the funding request.
Close the app routes around your filter
Category blocklists for iPads, iPhones, Android and Chromebook Android apps: VPN and proxy, remote access, chat, adult, gambling, dating and more, updated monthly.
iPad, iPhone and Apple School Manager are trademarks of Apple Inc. Chromebook, Google, Google Admin and YouTube are trademarks of Google LLC. Microsoft Intune and Windows are trademarks of Microsoft Corporation. Zoom is a trademark of Zoom Communications, Inc.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies. This page summarizes public program rules and is not legal advice.