Private DNS, Family Link, app restrictions and Chrome settings — the full Android toolkit.
Android has a built-in kill switch most people never find: Settings → Network & Internet → Private DNS. Enter a DNS service that filters adult content (Cloudflare's 1.1.1.3, OpenDNS FamilyShield 208.67.222.123) and every app on the device — browsers included — is filtered at the network level. It's free and takes 30 seconds.
For a phone you're setting up for someone else (a teen's device), Google Family Link is the right tool: it applies content restrictions, app approvals and time limits, and they can't be removed without the parent account.
Private DNS covers Chrome automatically. Add app-level discipline: uninstall or hide the apps that serve adult content, turn on Play Protect's family settings, and avoid sideloaded browsers that ignore system DNS. Every browser you don't install is one more wall you didn't need.
Device filters travel with the device; router filters cover the house. Combine Private DNS on the phone with a filtered DNS on your router for layered protection — see our Windows and blocker guides for the full setup.