Overview

The Apple iOS/iPadOS Content & Privacy Restrictions Policy controls the content restrictions that iPhone and iPad show under Settings > Screen Time > Content & Privacy Restrictions. Use it to set:

The maximum age ratings for apps, movies, and TV shows
App exemptions for organization-approved apps
Whether explicit music, podcasts, news, and books are allowed
Access to the Book Store, Apple Music, and Apple Music Radio
Safari and web content filtering with Apple's built-in filter
Whether users can turn on Screen Time

The restrictions apply whether or not Screen Time is enabled by the user, and users cannot modify or loosen MDM-enforced restrictions in Screen Time.

Important: Web content filtering requires a supervised device (enrolled via Automated Device Enrollment / DEP or prepared with Apple Configurator). If Web Content is set to anything other than Unrestricted on unsupervised devices (such as account-driven SSO or profile-enrolled devices), iOS/iPadOS rejects the profile installation completely with error 40003: Unsupervised devices require a ContentFilterUUID. None of the policy's restrictions will apply in that case. Always assign web content filtering policies only to supervised device groups.

Supported platforms and requirements

Item	Details
Platforms	iOS, iPadOS
Minimum OS	iOS 12.0 or later, iPadOS 13.1 or later (certain settings require later versions; see settings table)
Device ownership	Company-owned devices
Supervision	Most settings require a supervised device. Devices are supervised when enrolled through Automated Device Enrollment (DEP) or prepared with Apple Configurator.
Account-Driven SSO / Profile Enrollment	Supported for age ratings and app exemptions only (unsupervised).
User Enrollment (BYOD)	Not supported. Apple does not allow content and privacy restriction payloads on User Enrollment.

What applies on SSO and Profile-enrolled devices (Unsupervised)

On unsupervised devices, such as those enrolled via Account-Driven Enrollment (Enrollment SSO) or direct Swif Profile enrollment, only the following settings apply:

Apps age ratings (ratingApps)
Apps Exempted From Age Rating (ratingAppsExemptedBundleIDs — iOS/iPadOS 26.1+)
Movies age ratings (ratingMovies)
TV Shows age ratings (ratingTVShows)

Settings requiring Automated Device Enrollment (DEP / Supervised):

The following features are ignored or rejected on unsupervised / SSO / profile-enrolled devices and require a supervised device:

Web Content Filtering (webContentFilterMode — must be set to Unrestricted on unsupervised devices to prevent profile installation failure)
Allow Book Store (allowBookstore)
Allow Explicit Books (allowBookstoreErotica)
Allow Explicit Music, Podcasts and News (allowExplicitContent)
Allow Apple Music & Apple Music Radio (allowMusicService)
Allow Screen Time toggle (allowEnablingRestrictions)

Note: Apple has deprecated content restrictions on unsupervised devices and may require supervision for all rating controls in future major OS releases. We recommend enrolling devices via Automated Device Enrollment (DEP) where restrictions are critical.

Settings reference

All defaults leave the device unrestricted.

Age ratings

Setting	What it does	Options	Default	Supervision	Minimum OS
Apps	Highest app age rating allowed. The device hides installed apps rated above this and blocks new installations.	Don't Allow Apps, 4+, 9+, 13+, 16+, 18+, Allow All Apps	Allow All Apps	Not required (works on SSO / Profile enrollment; deprecated by Apple)	iOS 5.0, iPadOS 13.1
Apps Exempted From Age Rating	Bundle IDs of apps that remain available regardless of the Apps rating (e.g., internal work apps).	List of bundle IDs	Empty	Not required (works on SSO / Profile enrollment)	iOS 26.1, iPadOS 26.1
Movies	Highest movie rating allowed (U.S. ratings).	Don't Allow Movies, G, PG, PG-13, R, NC-17, Allow All Movies	Allow All Movies	Not required (works on SSO / Profile enrollment)	iOS 5.0, iPadOS 13.1
TV Shows	Highest TV rating allowed (U.S. ratings).	Don't Allow TV Shows, TV-Y, TV-Y7, TV-G, TV-PG, TV-14, TV-MA, Allow All TV Shows	Allow All TV Shows	Not required (works on SSO / Profile enrollment)	iOS 5.0, iPadOS 13.1

Explicit content, books, and music

Setting	What it does	Default	Supervision	Minimum OS
Allow Explicit Music, Podcasts and News	When off, hides explicit media from the iTunes Store, Podcasts, and News.	On	Required (Supervised / DEP only)	iOS 5.0 (iOS 13+ enforced)
Allow Book Store	When off, removes the Book Store tab from Apple Books.	On	Required (Supervised / DEP only)	iOS 6.0, iPadOS 13.1
Allow Explicit Books	When off, restricts downloading Apple Books content marked as explicit/erotica.	On	Required (Supervised / DEP only)	iOS 6.0, iPadOS 13.1
Allow Apple Music	When off, Apple Music is disabled and the Music app runs in classic playback mode.	On	Required (Supervised / DEP only)	iOS 9.3, iPadOS 13.1
Allow Apple Music Radio	When off, disables Apple Music Radio.	On	Required (Supervised / DEP only)	iOS 9.3, iPadOS 13.1

Web content

Setting	What it does	Default	Supervision	Minimum OS
Web Content	Enables built-in Apple web filtering (Unrestricted, Limit Adult Websites, or Allowed Websites Only).	Unrestricted	Required for any mode other than Unrestricted	iOS 7.0, iPadOS 13.1
Always Allowed Websites	URLs allowed even if flagged by automatic filters.	Empty	Required	iOS 7.0, iPadOS 13.1
Never Allowed Websites	Explicitly blocked URLs (up to 500).	Empty	Required	iOS 14.5, iPadOS 14.5
Allowed Websites	Whitelisted bookmarks in Allowed Websites Only mode.	Empty	Required	iOS 14.5, iPadOS 14.5

When a site is blocked, user will see this message:

💡 Tip: Advanced Web & Content Filtering
For granular domain blocking, DNS-layer security, category filtering, or custom secure resolvers (DoH/DoT), consider deploying the Apple DNS Settings Policy alongside or in place of Apple's built-in Screen Time content filter.

Screen Time

Setting	What it does	Default	Supervision	Minimum OS
Allow Screen Time	When off, prevents users from turning on Screen Time or configuring their own passcodes. MDM restrictions remain enforced.	On	Required (Supervised / DEP only)	iOS 12.0, iPadOS 13.1

Example configurations

Example 1: Supervised company-owned devices (DEP)

For corporate devices enrolled via Automated Device Enrollment where full media, book, and web restrictions are enforced.

Apps: Allow All Apps (or appropriate rating)
Allow Explicit Music, Podcasts and News: Off
Allow Explicit Books: Off
Allow Book Store: Off
Web Content: Limit Adult Websites (with Never Allowed Websites populated)
Allow Screen Time: On / Off as desired

Example 2: Unsupervised / SSO / Profile-enrolled devices

For devices enrolled via Enrollment SSO or direct profile installation.

Apps: 13+ (or organizational rating)
Apps Exempted From Age Rating: com.mycompany.app
Movies: PG-13
TV Shows: TV-14
All other media toggles and Web Content will be safely ignored by the device.

Troubleshooting

Profile fails to install with error 40003 / MCWebContentFilterErrorDomain

The target device is unsupervised (enrolled via SSO or manual profile) and the policy has Web Content set to a filtering mode. Set Web Content to Unrestricted for unsupervised devices, or enroll the device through Automated Device Enrollment (DEP).

Only age ratings take effect, while media and book restrictions are ignored

The device is unsupervised. Book Store, Explicit Media, Apple Music, and Screen Time toggles require a supervised device (DEP).

Nothing applies on a personal device

User Enrollment (BYOD) does not support Content & Privacy restriction payloads.