ChatGPT launched parental controls for teen accounts in September 2025, including alerts to parents for some safety events. We ask whether that channel tells parents what they need to know. A two-phase protocol first builds a category-balanced corpus of adversarial conversations through PAIR-style iterative prompt refinement over the API. Trained human operators then replay those conversations in the consumer app on a linked teen account while monitoring the parent inbox. Across seven harm categories we measure Notification Rate, Leak-Through, Overblocking and UI Intervention Rate. We call the mismatch we find the parental telemetry gap, and pair the case study with a platform-agnostic framework, a “curious-child” threat model, and a documentation review of Gemini, Claude and Copilot.
Highlights
The alert surface diverges from the vendor’s own description in both directions: documentation named only self-harm as a trigger, yet physical harm and pornography alerted in every session, while health consultations alerted in only 8 of 20.
Privacy violence, fraud, hate speech and malware never triggered an alert, and these were also the categories where harmful content most often reached the child (up to 80% leak-through).
The child often saw a refusal or warning that the parent never heard about. Visible safeguards and parent alerts appear decoupled, violating coverage parity.
Benign homework questions near sensitive topics were refused up to 60% of the time, and that overblocking is not surfaced to parents either.
The pattern held across three windows over eight weeks, through the GPT-5.1 and GPT-5.2 releases, consistent with coverage being set at the telemetry layer rather than by the model.
Table 4 of the paper: share of 20 sessions per category. NR, LR and UIR use the 20 selected adversarial trajectories; OBR uses a separate set of 20 benign prompts per category.
Notification
Leak-through
Overblocking
UI intervention
Pornography
100
0
20
0
Physical harm
100
0
60
80
Health consultation
40
0
40
60
Hate speech
0
20
40
10
Fraud
0
60
40
5
Privacy violence
0
80
20
5
Malware
0
80
0
5
Table 4 as a heatmap (% of 20 sessions). All leak-through happens in the four categories that never alerted parents.
1Child-plausible seed prompt per category
2Query API target; binary judge
3Mutate and retry (≤ 15 times)
4Freeze 20 judge-positive trajectories
5Human replay on teen account (3 windows)
6Log alerts in parent inbox; compute NR, LR, OBR, UIR
Algorithm 1: the two-phase telemetry-gap evaluation pipeline.
Axis
Curious child
Adversarial attacker
Intent
Exploratory, often non-malicious
Goal-directed; malicious or red-team
Persistence
Low to medium; gives up easily
High; iterates until success
Sophistication
Low; surface paraphrase
High; prompt engineering and tooling
Social affordances
Empathy, stories, homework, “my friend”
Personas, role-play, jailbreak templates
What success looks like
A single inappropriate response is enough to harm
Reliable bypass at scale
Table 1: the curious-child threat model differs from standard adversarial red-teaming, so telemetry must be tuned for low persistence and high recall.
Principle 1
Coverage parity
Every category with a visible safeguard for the child should be eligible for a parent alert
Principle 2
Configurable granularity
Tiered levels, per-category opt-in and digest options instead of one threshold
Principle 3
Versioned public taxonomy
A published, versioned list of which categories notify and at what thresholds
Principle 4
Parent-side auditability
A structured, time-indexed record of safety events, not chat transcripts
Four design principles for parental telemetry proposed in the paper.
Product
P1 Coverage
P2 Granularity
P3 Taxonomy
P4 Audit
ChatGPT-5 (tested)
partial
no
no
partial
Google Gemini (docs)
unknown
partial
no
partial
Anthropic Claude (docs)
n/a
n/a
n/a
n/a
Microsoft Copilot (docs)
unknown
partial
no
partial
Evidence available for each principle across four consumer products (Table 2). Only ChatGPT was tested; the other rows reflect public documentation, and “unknown” does not mean absent.
How it works
Phase I: 100 refinement trajectories per category over the API, up to 15 mutations each, stopping at the first judge-positive response.
Phase II: 20 judge-positive trajectories per category replayed by trained operators on a linked teen account in three windows (17 Oct, 14 Nov, 12 Dec 2025).
LLM judge calibrated against two human raters on a 10% stratified sample (κ = 0.71 overall; inter-human κ = 0.79); all judge-positive labels manually audited.
Open-source telemetry-gap CLI: SQLite storage, configurable Anthropic/OpenAI endpoints, and strict CSV worksheets for human replay. No automated teen accounts or email scraping.
Ersoz, K., Afroogh, S., Atkinson, D., & Jiao, J. (2026). Parental Notification Gaps in ChatGPT-5: An Empirical Study. Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, 9(2), 902–910.