Parental Control App Detection & Removal on Android

This guide is for two very different audiences. The first is a teen whose parents installed monitoring and who wants to understand what is on their phone — the right answer is usually “have the conversation with your parents,” but the technical detection still matters. The second is an adult who suspects an ex-partner, controlling partner, or other non-parent has installed monitoring on their phone — that is a different situation that requires more careful handling, covered at the end.

The five-minute detection checklist

Run through these five settings checks in order. They will catch 95% of monitoring apps including mSpy, Bark, Qustodio, Family Link, Eyezy, Cocospy, FlexiSpy, Hoverwatch, and most of the smaller players.

1. Battery usage — the loudest signal

Settings → Battery → Battery usage. Look at the per-app breakdown for the last 24 hours. Monitoring apps run constantly in the background and typically use 3-15% of daily battery. Apps you should expect to see using significant battery: the system, Google services, your messaging app, your social apps, your launcher.

Apps that should NOT be using significant battery: anything you do not recognise the name of, anything that calls itself “System Service” or “Sync” or “Update” but is not by Google, anything by a publisher you do not recognise. On Samsung devices, “Smart Manager” and “Device Care” are normal; on Pixels, “Pixel Setup” and “Now Playing” are normal.

2. Mobile data usage — the silent signal

Settings → Network and internet → Data usage → Mobile data. Look for apps that have used data in the last 7 days when you did not open them. Monitoring apps upload their data 1-4 times per hour, which shows up as small but persistent background data even when you have not opened the app.

Cross-reference against the battery list above. Anything appearing as suspicious in BOTH lists is almost certainly worth investigating.

3. Accessibility services — the technical fingerprint

Settings → Accessibility → Installed services (the exact path varies slightly per OEM — on Samsung it is Accessibility → Installed apps, on Xiaomi HyperOS it is Additional settings → Accessibility → Downloaded services).

This is the most reliable detection method because nearly every Android monitoring tool requires an enabled Accessibility Service to read screen content, log keystrokes and capture social DMs. The legitimate apps in this list are short: TalkBack, Select to Speak, Voice Access, Switch Access, manufacturer-installed accessibility tools, and any third-party accessibility tool you remember installing yourself (1Password, LastPass, Bitwarden, Tasker, Macrodroid, KWGT, etc).

Anything you do not recognise here is suspicious. Tap on it to see the app name and publisher. Common monitoring service names: “Update Service”, “Sync Service”, “Android Service”, “System Update”, “Device Admin”, “Google Service Framework Update” (real Google service framework does not appear in accessibility — this is a giveaway).

4. Device admin apps — the persistence signal

Settings → Security → Device admin apps (or Settings → Security and privacy → More security settings → Device admin apps on newer Samsung).

Monitoring tools often register as device admins to prevent uninstall via the standard Settings → Apps flow. Legitimate device admin apps: Find My Device (Google), corporate MDM apps if you have a work phone, Anti-theft apps you set up yourself, Samsung Knox if you have a Samsung work-profile.

Anything else here is suspicious and should be investigated. To uninstall a device-admin-registered app, you must first uncheck it as a device admin in this menu — that is the friction point monitoring tools rely on.

5. Notification access — the read-everything signal

Settings → Notifications → Notification access (on some OEMs: Settings → Apps → Special access → Notification access).

Notification access lets an app read every notification on the device including SMS previews, WhatsApp messages, social DMs, banking-app alerts and 2FA codes. Legitimate apps that need it: Wear OS / smartwatch companion apps, automation apps you set up (Tasker, MacroDroid), call-screening apps, KeepUp/Pushbullet style notification mirrors.

Anything else is suspicious. Monitoring tools commonly request notification access to capture incoming messages without needing root.

Common monitoring app fingerprints

Not all monitoring apps appear under their marketing names — they often install with generic-sounding package names to avoid casual detection. The package name appears at the top of the App info screen (Settings → Apps → tap the suspicious app → scroll to bottom for “App details” → may show “com.something.something”).

Tool	Common package names	Fingerprint
mSpy	com.systemupdate.service, com.android.bdc, com.bd.android.service	Hidden launcher icon, requires accessibility + device admin + notification access
Eyezy	com.eyezy, com.android.systemcore	Same permission set as mSpy, slightly different battery profile
Cocospy	com.svc.android.system, com.cocospy	Often appears as “System Update” in app drawer
FlexiSpy	com.flexispy, com.systemserver, com.bigbrother	Most aggressive permissions; often device admin + USB debugging trigger
Hoverwatch	com.hover.helper, com.android.helper	Hides as a system service, very low battery profile
Qustodio	com.qustodio.qustodioapp	Visible by default; package name not hidden
Bark	com.bark.bark	Visible by default; package name not hidden
Family Link	com.google.android.apps.kids.familylinkhelper (child app)	Visible “Supervised by parent” notice; cannot be hidden

The safe removal path

Once you have identified a monitoring app, the removal sequence matters. Doing it in the wrong order can either fail (app reinstalls itself) or alert the person who installed it (which may be what you want, or may not be).

Step 1 — Disable the supporting permissions first. Go to Accessibility → Installed services and disable the suspicious service. Go to Notification access and disable. Go to Device admin apps and uncheck. The app cannot easily reinstall its monitoring once these are off.

Step 2 — Disable network for the app. Settings → Apps → tap the suspicious app → Mobile data and Wi-Fi → set both to Off. This stops the app reporting whatever it has captured to the dashboard while you finish removal.

Step 3 — Uninstall normally. Settings → Apps → tap the suspicious app → Uninstall. With device admin disabled in Step 1, this should now work without errors. If it still does not uninstall, the app may have been installed via ADB with the special “uninstall protection” flag — which requires either a factory reset or an ADB-side pm uninstall --user 0 command (which our privacy hardening service can help with).

Step 4 — Factory reset if you want certainty. Settings → System → Reset → Erase all data. Back up your important data first (Google Photos, contacts to Google Contacts, WhatsApp via in-app backup). The factory reset is the nuclear option that guarantees no monitoring residue. After reset, do NOT restore from the cloud backup that was created while the monitoring was active — set up the phone fresh.

Step 5 — Audit your accounts after removal. Change passwords on email, banking, social media (do this from a different device that you know is clean). Check Google Account → Security → Your devices and remove any device sessions you do not recognise. If the monitor had access to your Google account, see the FAQ above on full account decoupling.

Special case — when removal could be dangerous

If the monitoring was installed by an intimate partner who is using it to control you, do NOT remove it without a safety plan. Sudden removal alerts the abuser that you have discovered the surveillance and very often escalates the situation — including physical danger.

In that situation:

• Reach out to a domestic-violence support line before removing anything. US: National DV Hotline 1-800-799-7233 (tech-safety team specifically trained on stalkerware). UK: Refuge 0808 2000 247. EU member states each have similar services.
• Do not search for “stalkerware” or “spy app” on the monitored phone — the monitoring captures search history. Use a friend’s phone, a public library computer, or a work computer that the abuser does not have access to.
• A clean second device (a cheap prepaid phone) is often the right intermediate step before removing the monitoring on the main device.
• Time the removal to coincide with a safety transition (leaving the situation, accessing a domestic-violence shelter, etc) rather than as an isolated technical action.

This is not a technical problem to be solved with the right Android settings. It is a safety problem that needs human support first and technical removal second.

If you want help with the audit

If you have read this and are not sure what is or is not legitimate on your phone, our privacy hardening service includes a remote audit where we walk through every accessibility service, device admin and notification access permission with you, identify anything suspicious, and remove it cleanly. The audit is the first 30 minutes of the session and is free of charge regardless of whether you proceed with the removal afterwards.

If you are a parent reading this because your teen found the monitoring app you installed — that situation is covered specifically in the legal guide to monitoring a teen under the “What to do if your teen finds the app” section.