T-Mobile Web Guard and CleanBrowsing

Step 1: What Is T-Mobile Web Guard?

T-Mobile Web Guard is a complimentary content filtering service designed to restrict adult content from being accessed by family members under 18 years old. It operates at the cellular network level — meaning it only works when devices are connected to T-Mobile's mobile data, not on Wi-Fi.

Web Guard is managed through the T-Mobile account dashboard or the T-Mobile app by the primary account holder.

Step 2: Web Guard Filter Levels

Web Guard offers three filtering tiers:

Low Filter

Blocks phishing attacks, malware, adult themes, nudity, and illegal content.

Medium Filter

Includes all Low-level restrictions plus automatic Safe Search activation across major search engines.

High Filter

Includes all Medium-level restrictions plus blocks for:

• Adware and tracking
• Social networking sites
• Video sharing platforms
• Messaging platforms
• Gambling-related content
• File storage services

Step 3: Safe Search Integration

When the Medium or High filter is active, Web Guard automatically enforces Safe Search across Google, YouTube, Bing, and DuckDuckGo. Users will see a message stating "You don't have permission to turn SafeSearch off" when they try to disable it.

This is similar to how CleanBrowsing's Family and Adult filters enforce Safe Search via DNS.

Step 4: Compatibility Issues

Web Guard has known conflicts with certain services:

• Apple iCloud Private Relay: Web Guard blocks Private Relay from functioning. Users who need Private Relay must disable Web Guard entirely.
• VPNs: T-Mobile notes that "content filtering may not be compatible with certain products or services, such as Virtual Private Networks." Some VPNs may not work properly with Web Guard active.
• DNS-based filtering: When on cellular data, T-Mobile controls the DNS path. Custom DNS settings (including CleanBrowsing) may be overridden by the carrier's network infrastructure.

Step 5: Using CleanBrowsing with T-Mobile

CleanBrowsing and T-Mobile Web Guard are independent services — CleanBrowsing is not affiliated with T-Mobile.

On Wi-Fi

When a T-Mobile device connects to Wi-Fi, Web Guard does not apply. CleanBrowsing DNS filtering will work normally if configured on the Wi-Fi network's router or the device itself.

On Cellular Data

On cellular data, T-Mobile's network may intercept DNS queries. To use CleanBrowsing on cellular, configure DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on the device:

• Android 9+: Use Private DNS with cleanbrowsing.org
• iOS: Install a CleanBrowsing DNS profile

Encrypted DNS (DoH/DoT) bypasses the carrier's DNS interception and ensures CleanBrowsing filtering is applied even on cellular data.