set whitelists/blacklists/etc on a per kid basis and adjust things as they get older. We also have a DNS based filter at the router level and have the router force all DNS requests to go through the router.