@margosa 

With the Deco M9 you have to do two things.

1.  Make a profile and add the devices to that profile 

2.  Block the content you want blocked. 

However, Apple and Google have made using parental controls much harder.  They both offer features that allow a user to randomize or spoof the device's MAC address.  On Android, this feature is listed under Settings > Connections > Current network Settings > View More >  Mac Address type.  On Apple, it is Private Wi-Fi address.  Settings > Wi-Fi > Tap on connected network name > Private Wi-Fi Address Toggle.  

What this does is generates a random WiFi address each time the device connects to the network.  Its a problem because it breaks your Parental controls because they rely on this address to know when a filtered device is online and on the network.  Because the system is being provided a random address by the device it does not detect that it is part of the filtered profile so it's open access.   Sure you can add whatever it is providing to the profile but if that device leaves the network and authenticates there is a good chance it will provide a new MAC address and again break the settings.  Unfortunately, it does not appear Apple or Google are going to do anything about this.  They feel this feature is a level of protection for a person's privacy and device, which technically it is, however, the side effect is that it breaks the parental controls of most routers, specifically any that use MAC identifiers to identify devices.  

These "features" also affect ACLs and Reserved DHCP addresses 

  @margosa 

I see.  I looked this up and found out that Windows also has this feature.  see here for details.  If it is enabled then the only solution I could really suggest since It is a windows system is create a new profile for your child that does not have admin rights.  then password-protect the admin profile so that they can't log into that and change the system settings.  That should work unless Microsoft in their infinite wisdom did not make the feature an admin feature.  Which is a possibility as well. 

Another, more costly option, is to install a managed network switch. on it you can create ACLs that block access to whatever you want to block.  Such ACLs can be set up to apply to all devices, except a specific white list of approved devices.  This way even if Radom MAC is being used its automatically Black Listed till the Mac is added to the white list.   

  @Geneo77 

Which model and can you share the current filters applied?