@Vic_R,

When the devices are accessing the sites, do you see any unrecognized devices on your home network? 

As you mentioned, the Parental Controls feature relies on the MAC address of a device to identify and assign them to a profile. Unforutnately, all smart phones now have a "Private Addressing" feature that allows the phone to provide a fake MAC address to the network. I have even now seen the feature on gaming consoles, PCs and even Smart TVs.

From a router standpoint, there is not too much that can be done when the router is given fake records that make the device look like an entirely different device.

Your son most likely had the setting disabled when you stored the MAC address and is able to toggle the setting on to send the network a different MAC address. OR if the setting was enabled, the device used a different fake MAC when it reconnected to the network. It is worth mentioning that I believe that the setting may be enabled by default, so it may simply be the result of not changing the setting off of its default value, and may not be a direct attempt at circumventing the filter.

This is something that our teams have definitely been working hard to provide solutions for, however, each iteration of phone and OS makes it more difficult to track devices between disconnects.

At CES this year, we actually announced a bunch of new features that would be coming to the HomeShield platform later this year. The new system will allow you much more control over the devices connected to your network and will prevent workarounds such as this. You can read the official press release to get an idea of the features that are being developed.