Chromebook setup guide

WhitelistVideo on Chromebook

Only the YouTube channels you approve play, on the device your child uses most. Pick the level of protection that fits your family, from a 10-minute setup to an extension that cannot be removed.

Start Free Test Compare the three levels

Last updated: September 2026

How does WhitelistVideo work on a Chromebook?

WhitelistVideo is a Chrome extension. Once it is installed on your child's Chromebook, every YouTube video is blocked by default and only the channels you approve from the parent dashboard will play. Shorts are off. The whitelist syncs with every other device your child uses. Because ChromeOS is built around Chrome, the same extension covers the whole device.

Can my child remove it?

That depends on who controls the Chromebook, not on the extension. ChromeOS lets any user remove any extension, and Google states that removing one on a Family Link Chromebook needs no parent permission (re-adding does). WhitelistVideo is designed to run on top of the control you already have: with Family Link, you are alerted by email if the extension is uninstalled and re-installing needs your approval; with a managed device (your school's Google Admin console, or your own Google Workspace subscription at about US $5 per month; check Google's pricing for your region), the extension is force-installed and cannot be removed or disabled.

Three levels of protection

Start at level 1. Move up only if your child needs it.

WhitelistVideo + Family Link

Free10 minutes

The extension does the filtering; Family Link makes every install a parent decision and keeps Guest mode off.

Installing any extension or Android app needs your approval, so re-adding WhitelistVideo after a removal goes through you
If the extension is uninstalled you are alerted by email; if it is disabled, your dashboard shows the device as inactive within minutes
Block Guest mode and Incognito, and keep the Family Link "Extensions" toggle off so installs always need approval
Turn off Family Link's own YouTube restrictions and don't block youtube.com; WhitelistVideo decides what plays. Optional: block google.com and set DuckDuckGo as the default search engine

Most families. Younger children who respond to "I'll know if you turn it off."

Family Link step-by-step guide

WhitelistVideo + school Admin console

Free5 minutes of your time

The school's IT admin force-installs the extension through the Google Admin console it already runs. Your child cannot remove or disable it.

Send your school IT the extension ID and the deployment guide below
The extension is pinned by device policy; the Remove button disappears
Your child signs in with the school account; you still manage the whitelist from your dashboard
Extension ID: mapkkanjgaongckjkhklbhekefemookh

Children on a school-issued Chromebook.

Deployment guide for school IT

WhitelistVideo + Google Workspace

About US $5 per month (check Google's pricing for your region)30 to 60 minutes, once

You buy a Google Workspace subscription, become the administrator in your own Google Admin console, the same tool schools use, and force-install the extension yourself. The child cannot remove it, disable it, or escape by factory resetting.

Extension force-installed; no Remove button on the child's account
Factory reset re-enrolls the device automatically
Incognito, Guest mode, developer tools and the Play Store can all be turned off
Full walkthrough below

Tech-savvy older children on a personal Chromebook.

Jump to the setup walkthrough

Which level do you need?

What each pairing gives you on a Chromebook

Scroll horizontally to see all columns.

	WhitelistVideo + Family Link	WhitelistVideo + Google Workspace	WhitelistVideo + School Admin console
Only approved channels play	Yes	Yes	Yes
Installing extensions	Needs your approval	Admin force-installs	IT admin force-installs
If your child removes the extension	You are alerted by email; re-adding needs your approval	Cannot be removed or disabled	Cannot be removed or disabled
Factory reset	Re-setup with your account	Device re-enrolls automatically	Device re-enrolls automatically
Incognito	Block it in Family Link	Blocked by policy	Blocked by policy
Guest mode	Block it in Family Link	Blocked by policy	Blocked by policy
Other browsers (Android apps)	Each install needs your approval	Play Store can be turned off	Play Store can be turned off
Setup	10 minutes	30 to 60 minutes, once	5 minutes (ask school IT)
Cost	Free	About US $5 per month (check Google's pricing for your region)	Free

Start Free Test

Locking the extension on a personal Chromebook

ChromeOS only lets a device administrator force-install an extension. A Google Workspace subscription (about US $5 per month; check Google's pricing for your region) makes you that administrator for your child's Chromebook. It is one purchase and a one-time setup, and afterwards the whitelist runs exactly as before; the only change is that the extension can no longer be removed.

What you need

A Google Workspace subscription

About US $5 per month; check Google's pricing for your region. It gives you the Google Admin console at admin.google.com, where you are the administrator.

A domain name

Your Google Workspace account runs on a domain you own, such as yourfamily.com. Google can sell you one during signup.

The Chromebook, backed up

Enrollment requires a factory reset (Powerwash). Anything stored only on the device is erased.

What it costs

Item	Monthly	Annual
Google Workspace subscription	About US $5	Check Google's pricing for your region
Total	About US $5 per month	Plus a domain if you need one

The Google Workspace subscription is the only purchase, apart from a domain if you do not already own one. It is about US $5 per month; check Google's pricing for your region.

Setup walkthrough

1
Buy Google Workspace and set up your Admin console
Buy a Google Workspace subscription (about US $5 per month; check Google's pricing for your region) and sign up with your domain. Think of the Admin console as your family's control centre: you will create accounts like parent@yourfamily.com and child@yourfamily.com. The child's account is the one that gets the restrictions. You now have the Google Admin console at admin.google.com.
2
Check your subscription in the Admin console
Sign in at admin.google.com as the administrator, go to Billing and confirm your Google Workspace subscription is active. It is the only purchase you need. Chrome Enterprise Core, the free browser-management tool, does not manage Chromebooks, so it cannot stand in for the subscription.
3
Factory reset (Powerwash) the Chromebook
Back up anything stored on the device. Sign out, press Ctrl + Alt + Shift + R at the sign-in screen, click Restart, then Powerwash and Continue. The device must be enrolled before anyone signs in; if someone signs in first, Powerwash again.
4
Enroll the device
After the reset, connect to Wi-Fi. On the setup screen choose Enroll the device (or press Ctrl + Alt + E), sign in with your Admin console account, skip asset ID and location, and choose Enroll enterprise device. Check Devices, Chrome, Devices in the Admin console: the Chromebook should be listed.
5
Create a unit for your child
In the Admin console go to Directory, then Organizational units, and create one called Kids (or your child's name). Move your child's account into it. Policies apply per unit, so you stay unrestricted at the top level and the lockdown applies only to your child.
6
Force-install WhitelistVideo
Go to Devices, Chrome, Apps & extensions, and open the Users & browsers tab. Select the Kids unit, click the yellow plus button, choose Add from Chrome Web Store, and paste the extension ID mapkkanjgaongckjkhklbhekefemookh. Under Installation policy choose Force install (or Force install + pin to ChromeOS taskbar) and save. On the child's Chromebook, chrome://extensions now shows WhitelistVideo with no Remove button.
7
Confirm forced re-enrollment
Go to Devices, Chrome, Settings, Device settings and find Forced re-enrollment under Enrollment and Access. It should read Force device to automatically re-enroll after wiping; that is Google's default. With it on, a factory reset brings the device straight back under your management and developer mode is disabled. Only you can release the device, by deprovisioning it in the Admin console.
8
Add the protective policies
Still under Devices, Chrome, Settings, for the Kids unit: disallow Incognito mode, disable Guest mode, never allow developer tools, block ending processes in Task manager, restrict sign-in to your domain, block secondary accounts, and turn off the Google Play Store and Linux so no other browser can be installed. Then sign your child in with their child@yourfamily.com account and pair the extension with your WhitelistVideo dashboard as usual.

Extension details for the Admin console

Extension ID: mapkkanjgaongckjkhklbhekefemookh
Chrome Web Store: https://chromewebstore.google.com/detail/mapkkanjgaongckjkhklbhekefemookh
Force-install policy string: mapkkanjgaongckjkhklbhekefemookh;https://clients2.google.com/service/update2/crx

Chromebook questions

No. With forced re-enrollment on (Google's default), the device re-enrolls into your account after any wipe, without needing credentials, and developer mode is disabled. Only you can release it, by deprovisioning the device in the Admin console.

Yes. Your child signs into the Chromebook with an account you create in your Admin console, such as child@yourfamily.com. That is what makes the unit's policies apply. A personal Gmail account would not carry them, which is why the sign-in restriction in step 8 matters.

Chrome is the only native browser on ChromeOS, but Android browsers such as Firefox can be installed from the Play Store. With Family Link, each install is a request you approve or deny in the Family Link app. On an enrolled device you can turn the Play Store off entirely.

No. Chrome Enterprise Core manages the Chrome browser on Windows, Mac, Linux, iOS and Android. It does not manage ChromeOS devices. Locking an extension on a Chromebook needs a Google Workspace subscription (about US $5 per month; check Google's pricing for your region), which gives you the Google Admin console.

School devices are already enrolled in the school's account, so you cannot enroll them yourself. Ask the school's IT admin to force-install WhitelistVideo instead; the deployment guide above has everything they need.

It is a one-time, 30-to-60-minute job in a tool built for IT staff, so give yourself an evening. The steps above are in order and each one is short. Once it is done there is nothing to maintain, and most families never need it: level 1 with Family Link is enough when your child responds to knowing you get an email if the extension is removed.

On Windows and Mac the WhitelistVideo desktop installer writes the same force-install policy for you, so removing the extension needs the administrator password and no enterprise enrollment is required. Chromebooks need this guide only because ChromeOS does not let an installer write device policy.

Start with the extension. Lock it later if you need to.

Install WhitelistVideo on your child's Chromebook, approve a few channels, and see how the whitelist works during the free test period. Levels 2 and 3 add on to the same setup.

Start Free Test Open the download page

Free 2-hour test period

Shorts off by default

Same whitelist on every device

WhitelistVideo on Chromebook