MAC White-list is paramount to implementing proper Parental Control. 

Access to Deco WiFi and Internet is based on MAC Address of a Device. All Parental control and access control is based on a Device's MAC Address. You can Black-list a MAC Address as well.

1. However, you can change MAC address of a device 
2. These days most OS uses Internal local MAC Address hiding its real MAC Address. (This can be easily disabled though)

Problem is, once the MAC address is changes, the device get full access to Internet !!! We just need to apply that new MAC address to "Access Control group" or black-list again. It is an issue. 

The proper implementation would be :

a. if implementation of MAC WHITE-LIST is a serious challenge :  

                There could be a DEFAULT ACCESS GROUP  :
                1. Any new devices would be automatically connected and assigned to this group unless user assigns  them to another list. 

                2. User/admin can apply access rules to this DEFAULT GROUP just like any other Group he can create including Blocking full internet access 
                3. This could be quickest implementation path and is also friendly with current Device OSes which changes their MAC Addresses automatically.

b. Implement White Listing 
                1. If white-list MAC is enabled then only ALLOW Listed MAC Addresses to connect to WIFI