Why a school needs content filtering: what is at stake

Filtering is not just a matter for the IT department

It is easy to think of filtering as just another firewall function: certain pages are blocked, others are allowed and the matter is settled. In a school, however, the decision is far more complex, because the technology has to respond to a policy decided beforehand. The school has to decide what kind of access it wants to give pupils, what differences there will be between phases of education, which content should be restricted and how much freedom teachers need to work normally. A policy suitable for an eight-year-old is unlikely to be the same as for a seventeen-year-old, and a configuration that works well for a primary group (ages 6–12) may be completely unsuitable in Bachillerato (ages 16–18).

Exceptions also have to be considered. A filtering system can mistakenly block a legitimate page that a teacher needs for a lesson starting in twenty minutes. In that case it is not enough for the system to be able to block; there has to be a clear and quick way of reviewing the issue and authorising the resource when appropriate. That difference matters: having a filter installed is one thing, and having a filtering policy designed to work in the day-to-day life of a school is quite another.

The school is responsible for the environment it provides for pupils

The protection of minors within the school does not disappear when an activity moves from a book or the playground to a screen. Article 1903 of the Spanish Civil Code establishes the liability of the owning bodies of schools below higher education level for damage caused by pupils who are minors while they are under the control or supervision of teachers in school, extracurricular and supplementary activities. Spain's Organic Law 8/2021 on the comprehensive protection of children and adolescents against violence also sets out obligations in education relating to digital safety and responsibility, action protocols and the role of the wellbeing and protection coordinator. Added to this is the Organic Law on Education, which expressly provides for the need to reduce the risks arising from inappropriate use of technology in schools.

This does not mean that installing a filtering system removes the school's responsibility, or that anyone can ensure inappropriate content will never be accessed. No tool can promise anything of the kind. What a school can do is have a defined policy, apply technical measures consistent with that policy and be able to review what happened when an incident arises. The difference between having that framework and being unable to show any measures at all matters both educationally and for the management of the school itself.

The problem goes far beyond sexual content

When filtering in schools comes up, the first category mentioned is usually pornography, and understandably so. The report ‘Desinformación sexual: pornografía y adolescencia’, published by Save the Children in 2020 on the basis of a survey of 1,753 adolescents aged between 13 and 17, put the average age of first access to pornography at 12. Meanwhile, according to the 2025 Survey on Equipment and Use of Information and Communication Technologies in Households by Spain's National Statistics Institute (INE), 96.5% of children aged between 10 and 15 used the internet. These figures help to explain why access to certain content is an increasing concern for schools and families.

But reducing filtering to blocking sexual content leaves out a large part of the problem. There is also violent content, gambling-related pages, communities that normalise self-harm or eating disorders, scams aimed at teenagers, anonymous messaging, certain chat rooms, personal storage services and online tools that the school may consider unsuitable for certain ages or contexts. According to ESTUDES 2023 survey data compiled by the Spanish Observatory on Drugs and Addictions, 10.7% of students aged 14 to 18 had gambled money online in the previous twelve months.

That is why a filtering policy should not start by asking only which pages need to be blocked. The underlying question is much broader: what kind of internet access the school wants to provide from its devices and its network during the school day.

Filtering does not mean banning the internet

One of the most reasonable objections raised when this subject comes up at a staff meeting is whether filtering content could end up becoming a form of overprotection. Pupils need to learn to use the internet with discernment, recognise false content, spot risks, manage their privacy and find their way around digital environments that will not be filtered outside school. That education is indispensable and no technology tool can replace it.

That said, teaching responsible internet use does not mean that any content should be available from any school device and at any age. The school already takes similar decisions in other areas: it chooses the books in the library, decides which films can be shown, which activities are appropriate for each phase and which resources teachers use in class. Something similar happens with the internet. The school defines which resources it makes available to pupils in an educational context and within what limits.

So a good filtering policy is not about blocking as much as possible. It is about restricting what genuinely poses a risk or makes no sense in an educational setting, and allowing everything pupils and teachers need to learn and work normally.

Primary, secondary and Bachillerato do not need the same internet

Age and phase of education make a big difference to the kind of access it makes sense to provide. In primary it is usually reasonable to work with a more controlled environment, while in secondary access to certain resources can be widened gradually. In Bachillerato autonomy should be considerably greater, because students need to research, compare sources, use a range of tools and work in a way closer to what they will find in higher education.

This means the system has to be able to apply different policies by group, profile or phase rather than simply a list of blocked pages for the whole school. Teachers also need a different level of access from pupils, as they may require resources that it would make no sense to leave directly available to a pupil. That is why at PenwinEdu we insist on linking identity, device and policy: knowing who is connecting makes it possible to apply the right rules to each profile without making the whole school browse under the same restrictions.

If the school does not detect it, the problem does not go away

An infrastructure that does not reveal certain problems can give the impression that those problems do not exist. With filtering, a school that has no tool for detecting certain kinds of access simply does not know whether they are happening. The issue usually comes to light when someone reports it, whether a teacher, a pupil or, often, a family. And if the report arrives several days or weeks later, reconstructing what happened is much harder.

Then the questions begin: which device it was accessed from, when, whether it was a one-off or had been happening repeatedly, which network was used and whether other pupils were involved. A properly designed system can provide useful information to understand what has happened and act with better judgement. That does not mean turning the school network into a system of permanent surveillance of pupils. Logging certain browsing data and individually monitoring what a person does are different decisions, and the school has to define clearly what it needs to log, who can consult that information and for how long.

A good policy also protects the relationship with families

Families can come to this subject from very different positions. Some want to know what the school is doing to stop their children accessing certain content; others may be concerned about the level of control the school exercises over pupils' digital activity. Both concerns are reasonable, and the school should be able to answer both with something more than an improvised explanation when an incident occurs.

The best way to do that is to have a clear policy that people know about. That policy should explain which categories are blocked, what differences there are by age, what information is logged, who can consult it, how a family can raise a question or a disagreement and what happens when the system blocks a resource that should in fact be allowed. When these decisions are made and communicated before a problem arises, filtering no longer looks like a tool switched on by IT and becomes part of the school's educational and behaviour policy.

How we approach filtering at PenwinEdu

At PenwinEdu we do not start a filtering project by asking how many licences the school needs. First we need to understand how the school works: which phases it has, which devices it uses, how pupils access the internet, what teachers need, which system it uses to identify its users and how much autonomy it wants to offer at each age. It is also important to know who will manage exceptions, how quickly the school needs to be able to respond and how it wants to act when an alert comes up during the school year.

From there, the policy is designed and a decision is made on how it should be applied technically, whether from the firewall, from the devices themselves or by combining both layers. These are the questions we review:

• Which categories of content should be restricted in each phase of education.
• What differences there should be between pupils, teachers and administrative staff.
• What happens when a device leaves the school and connects to another network.
• How devices that do not belong to the school but access its network are managed.
• What information it makes sense to log, and for how long.
• Who will be able to consult that information.
• How a legitimate resource needed in class can be unblocked quickly, and who can do it.
• What procedure is followed when content that should have been blocked gets through.

Educational experience is part of the solution

There is no universal configuration that works for every school. Two schools with the same number of pupils may need very different policies because of the ages they cater for, their educational approach, the type of devices they use or the level of autonomy they want to give their pupils. That is why filtering has to adapt to the school, not the other way round.

A firewall or a filtering platform may offer hundreds of configuration options. Knowing which ones to use, when and with what level of restriction is another matter. At PenwinEdu we have spent years working with schools and we are familiar with many of the situations that arise in classrooms, in IT departments and in the relationship with families. That experience is what we bring to our clients when we design a filtering policy.

Our work is not just about installing a tool or setting up some rules on a firewall. It is about striking a reasonable balance between security, safeguarding, privacy and freedom, so that teachers and pupils can work normally. That balance is not the same in primary, secondary or Bachillerato, and it need not be the same in two different schools either. Understanding that educational reality is as important as knowing the technology behind it.

PenwinSafe: filtering and management designed for schools

At PenwinEdu we roll out and maintain content filtering and device management solutions specifically for schools. With PenwinSafe, the school can apply different policies by user, group and phase of education, with centralised management adapted to its circumstances. The aim is not simply to block content, but to make sure the policy the school has defined can be applied consistently and manageably throughout the school year.

Nor does the project end on installation day. Needs change, new platforms appear, apps are added and certain resources that do not exist today may become everyday classroom tools tomorrow. That is why ongoing guidance and support are part of the solution. PenwinSafe is available from €3.50 per device per year, and the initial assessment of the school is free and comes with no obligation.