Apple's new iPhone software is supposed to limit who your kid talks to, but a bug lets them get around it

Key Points
  • Apple's iOS 13.3 launches this week and introduces a new feature called Communication Limits that adds new parental controls.
  • It's supposed to allow parents to limit their kids' communications only to people who are in their contacts list.
  • But a bug lets children talk to anyone who contacts them.
Child using a phone.
Amir Mukhtar | Moment | Getty Images

Apple rolled out iOS 13.3 on Tuesday with new controls that are supposed to give parents power over who their children talk to on an iPhone or iPad. It's a big new feature that Apple is advertising and has garnered lots of press.

But CNBC discovered it doesn't work properly. There are several bugs with the feature, but, most importantly, it doesn't protect your kids from talking to strangers on the phone, FaceTime or through text messages.

Here's what's going on:

The new software includes a new Communication Limits option that lets parents control who their kids can talk to. It's supposed to let parents block their children from contacting anyone who isn't in their address book. Children are also supposed to be prevented from adding new contacts unless a parent enters a PIN they set up ahead of time.

So, for example, if a parent doesn't want their kid talking to a bully at school, they can just remove the bully from their child's address book and they won't be able to do it.

But Communication Limits does not work as advertised if contacts are not stored to iCloud by default.

The main Screen Time page where you'll configure parental controls on an iPhone or iPad.
Todd Haselton | CNBC

CNBC set up Communication Limits on an iPhone running iOS 13.3 so that a child can't communicate with a number that's not in their address book.

But we discovered that when an unknown number texts the child's phone, the child is given the option to add the number to their address book. After the kid adds the number to the address book, they can call, FaceTime or text that number.

A child should not be able to add the contact to the iPhone's address book without their parent entering their PIN first if the feature is working properly.

Choose who your kids can contact during regular hours before Downtime.
Todd Haselton | CNBC

CNBC also noticed that the keyboard sometimes vanishes on the first attempt to respond to a text message after the contact has been added. But going back a screen and then tapping back into the message thread brings the keyboard back.

Kids can also skirt the protections using an Apple Watch paired to the iPhone. If they ask Siri on an Apple Watch to text or call any number, it will go through, whether it's in the contact list or not.

There is one exception to this bug.

If the Downtime feature is enabled on the kid's phone, they are not given the option to add a number to their address book after being contacted. Downtime is another feature in iOS. It lets parents limit which apps and features a child can use during certain periods of time. (For example, you can block your kid from using apps from 10 p.m. to 6 a.m. the next day while they're supposed to be sleeping.)

Apple told CNBC, "This issue only occurs on devices set up with a non-standard configuration, and a workaround is available. We're working on a complete fix and will release it in an upcoming software update."

In the meantime, parents can do the following to force contacts to sync with iCloud, which prevents the bug from occurring on phones that default to syncing contacts with Gmail or other services.

  • Open Settings.
  • Open Contacts.
  • Select Default Account.
  • Change it to iCloud from any other setting (like Gmail or another account.)

If you don't have your contacts synced to iCloud, the Communication Limits feature still works in some parts of iOS. Children can't manually go into their address book and add a new one without the parent's PIN. And they can't use Siri to try to get around protections to place calls to unknown numbers.

Apple could fix the bug by removing the "Add Contact" button when a child receives a text from a number not in their address book. Or it could require a parent's PIN before the child is allowed to save a new contact.

There are a couple of other bugs CNBC discovered while testing the new parental control features in iOS 13.3. In some instances, for example, contacts in the address book are blocked for no apparent reason. And sometimes the text message inbox is completely unreadable, with contact photos mixed on top of the preview text.

Some contacts are blocked for no reason.
Todd Haselton | CNBC

Apple first launched iOS 13 in September and it has since been updated more often than usual to fix lots of bugs. Bloomberg reported last month that Apple plans to address buggy iOS releases with its next version, iOS 14.

— CNBC's Kif Leswing contributed to this report.

Follow @CNBCtech on Twitter for the latest tech product news.