Choosing a web filter for a public library
Most filters are built for schools, where students sign in on devices the school manages. A library serves adults, teenagers and young children at the same time, mostly without a login, on public PCs and on their own phones. This guide sets out the requirements that are specific to libraries, the questions to ask any vendor, the red flags, and how to test a filter on one branch or one network before you commit. A printable checklist sits near the end.
Looking at our hosted CIPA filter?
- One libraryFrom $99 a month per site, nothing to install. See plans and prices
- A library systemA written quote within one business day, each option priced. Ask for a quote
- Before you chooseSee which parts of CIPA you already have in place. Free CIPA readiness check
This guide is general information, not legal advice. Legal statements come from the statute, the FCC and USAC, listed at the end of the page. It names no other filter products. The questions work for any vendor, including us.
What CIPA asks of a library, and what it leaves to you
Start the search with the legal minimum. It is narrower than many people think, and everything above it is your board's choice.
- When it applies. A library that receives E-Rate discounts for internet access or Category Two services, such as internal connections, must certify CIPA compliance. A library with discounts only for telecommunications services certifies that CIPA does not apply. A similar condition applies to some libraries that use LSTA money to buy computers used to access the internet or to pay direct costs of internet access.
- What the filter must do. The library enforces a technology protection measure on any of its computers with internet access. It must block visual depictions that are obscene or child pornography for everyone, and visual depictions that are harmful to minors when minors use the computer. A minor is anyone under 17.
- Adults. An administrator, supervisor or other person authorized by the library may disable the measure during use by an adult, to enable access for bona fide research or other lawful purposes. USAC's example for libraries is a sign-in page where the adult affirms that purpose. The FCC chose not to write rules on how libraries carry this out and left it to local communities.
- The policy. The internet safety policy must address minors' access to inappropriate matter, the safety of minors in email, chat and other direct communications, hacking and other unlawful activity by minors, the disclosure of minors' personal information, and measures to restrict minors' access to harmful material. It is adopted after reasonable public notice and at least one public hearing or meeting.
- Local decisions. What matter is inappropriate for minors is decided by the library, the library board or another responsible authority. No federal agency may set the criteria.
- No tracking required. The FCC said in 2001 that CIPA does not require the tracking of internet use by any identifiable minor or adult user. USAC lists monitoring the online activities of minors as a policy requirement for schools, not for libraries.
So a library filter has three jobs: make the legal minimum easy to enforce, make every extra choice of your board visible and adjustable, and add no record-keeping the law does not ask for. Our guides to the public library internet filtering policy and the CIPA internet safety policy cover the policy side.
Eight requirements that are specific to libraries
A school filter can pass a school's checklist and still fail at a library desk. These eight requirements are where the difference shows.
1. Adult disabling on request
The statute gives adults a route to lawful material, and patrons will use it. The desk has to run it on a busy afternoon, without IT.
What good looks like
- Any authorized staff member can do it in under a minute, from the desk or a phone.
- It is limited in scope, such as one computer or one network, and in time, and it switches back on by itself.
- It opens only what your policy allows adults to reach. VPN and proxy tools stay blocked.
- The record shows that a disable happened and for how long, not what the adult read.
- Optionally, adults can unblock a site themselves on adult computers, after affirming their age and purpose.
More detail: CIPA adult unblocking in libraries and patron self-unblock.
2. Children's areas with their own rules
The children's room usually gets stricter rules than the adult floor, and nobody signs in to those computers. Most libraries reach the internet through one public address, so the filter cannot tell computers apart by address alone.
What good looks like
- A children's profile without patron logins, reached by a separate network, a setting on the children's computers, or the firewall.
- Forced safe search and restricted video modes on children's computers.
- No adult bypass on the children's computers, so a disable at the adult desk never reaches them.
- The same children's rules in every branch.
More detail: children's area internet filtering in libraries.
3. Patron privacy and short records
Reading is private in a library. CIPA does not require tracking, and your state may protect library user records by law. A filter log tied to a named patron can become such a record.
What good looks like
- Records by device or network, never by patron name or card number.
- A retention period you choose and can shorten, with records removed when it ends.
- Named staff roles that can read the log, and a vendor that looks only when you ask for help.
- No screenshot, keystroke or alert features aimed at adult patrons.
- Board reports in totals, never reading histories.
Ask your attorney or state library agency how your state's library records law applies to filter logs, and write the answer into your policy.
4. Patron Wi-Fi with nothing installed on patron devices
Patron phones and laptops are often the largest group of devices on the network. You cannot install software or a certificate on them, and you should not ask patrons to.
What good looks like
- Filtering at the network, so every device that joins the Wi-Fi is covered without setup.
- A clear answer on what a patron sees when an encrypted site is blocked. Without a certificate on the device, a browser warning instead of a branded block page is normal.
- Common workarounds handled: VPN and proxy sites, and browser settings that send lookups to an outside encrypted DNS service.
More detail: library Wi-Fi and patron devices and router or software on each device.
5. Unblock requests staff can close in a minute
Every filter blocks some sites by mistake. In a library the cost lands at the desk, in front of a patron who needs a job form or a health page now.
What good looks like
- An always-allow list that trained staff can update, which beats any category.
- Changes that apply within seconds or minutes, not after a nightly update.
- A way to look up how a site is categorized before you change anything.
- A route to report a wrong category to the vendor, and a fix that reaches every library.
- A request log that records the site, the date and the outcome, not the patron.
More detail: library staff guide to filter requests.
6. Intellectual freedom and over-blocking
CIPA names three classes of visual depictions. Filters block by category, and broad categories can catch health information, sex education, art, support services and news. When a filter over-blocks, patrons notice at once, and your board will hear about it.
What good looks like
- A narrow default CIPA setting, with every extra category switched on by choice.
- A published list of what is blocked and why, which you can show patrons.
- Library staples kept open: your catalog, e-book and database services, government, job and health sites.
- An easy way for patrons to ask for a review of a blocked site.
More detail: intellectual freedom and library filtering.
7. Board and funder reporting
Boards ask whether the filter works and what the connection delivers. USAC's CIPA audit list includes a description of the filter and a report or other documentation on its use, showing it was installed and working during the funding year.
What good looks like
- Monthly reports per branch and for the whole system, ready to file.
- A record of which categories and lists were in force on a given date.
- A log of adult disables that shows the process works, without showing what was read.
- Totals the board can read: lookups, blocks, unblocks, busy hours.
USAC asks that audit records be kept for at least 10 years after the later of the last day of the funding year or the service delivery deadline. More detail: reporting library internet use to your board.
8. Staff computers, branches and lent devices
CIPA covers any of the library's computers with internet access, so staff computers count. Systems need the same rules in every branch. Lent laptops leave the building and the router filter with it.
What good looks like
- Lighter rules for staff computers that still block the CIPA categories.
- One console where each branch has its own settings, lists and staff disable code.
- Lent devices that keep the same rules on home or hotspot connections, locked so borrowers cannot remove them.
More detail: web filtering for library systems and library hotspot lending and filtering.
Questions to ask any vendor
Send the same questions to every vendor and ask for written answers. A short, specific answer is a good sign. A long answer that avoids the question is not.
| Topic | Question | A good answer sounds like |
|---|---|---|
| CIPA setting | What does your default CIPA setting block, category by category? | A short list you can read in a minute, with every other category off until you choose it. |
| Adults | How does staff disable the filter for an adult, and how does it end? | Steps at the desk in under a minute, a time limit, and an automatic return. |
| Adults | What does the disable open, and what stays blocked? | Only what your policy allows adults. Tools that hide traffic from the filter stay blocked. |
| Children | How does a children's computer get stricter rules when all traffic leaves one address? | A separate network, a setting on each children's computer, or the firewall. No patron logins needed. |
| Privacy | What is recorded for each lookup, and can it be tied to a patron? | Device or network, time, site and decision. No patron names unless you add them. |
| Privacy | How long are records kept by default, and can we set a shorter period? | A stated default and a setting or written agreement to shorten it. |
| Privacy | Who at your company can see our records, where are they stored, and what happens to them when we leave? | Named roles, a stated location and a deletion commitment in the contract. |
| Wi-Fi | Does anything have to be installed or accepted on patron devices? | No. |
| Wi-Fi | What does a patron see when an encrypted site is blocked? | A plain explanation, usually a browser warning, and wording you can put on a sign. |
| Unblocks | Who can add an allowed site, and how fast does it apply? | Trained staff, in seconds or minutes. |
| Accuracy | Can we look up how any site is categorized before we buy? | Yes, with a public lookup tool you can use today. |
| Accuracy | How are wrong categories reported and fixed? | A simple report route and a stated response time. |
| Reports | Which reports show the filter was working each month, per branch? | A monthly report and a policy record you can file without editing. |
| Branches | Can each branch have its own lists and disable code in one console? | Yes, with system-wide lists on top. |
| Lent devices | How do lent laptops stay filtered at home, and what does it cost per device? | A per-device setting locked by device management, with a stated price. |
| Setup | What do you do, what do we do, and what help is included in the first weeks? | A short list of steps with names on each side. |
| Price | What do you count, and how does the price change when we add PCs, branches or devices? | A rule you can apply yourself to next year's numbers. |
| Contract | What is the term, the notice period and the cap on renewal increases? | Written terms, with no automatic multi-year renewal. |
| Exit | Can we export our allow and block lists and our reports? | Yes, as plain files, at any time. |
| Testing | Can we start with one branch or one network before we commit the rest? | Yes, on normal terms you can end if it does not work. |
Red flags
Any one of these is worth a follow-up question. Two or three together are a reason to look elsewhere.
- "Our product makes you CIPA compliant." A filter covers the technology part. The policy, the notice and hearing, and the adult procedure are yours.
- Software or a certificate on patron devices. Patrons should not have to install anything to use the library Wi-Fi.
- Adult disabling needs IT. An admin password, a support ticket or a building-wide switch will slow the desk and push staff to say no.
- Records tied to patrons by default. Logs keyed to card numbers or names, or kept with no limit you can set.
- Monitoring sold as filtering. Screenshots, keystroke capture or alerts on adult searches go far beyond what CIPA asks of a library.
- A broad default you cannot see. Dozens of categories blocked out of the box, with no list of what they contain.
- No way to look up a site's category. You cannot judge over-blocking if you cannot see how sites are labelled.
- Counts you cannot verify. A price per patron, user or device on a network where most devices are anonymous, with a true-up later.
- Lock-in terms. Multi-year auto-renewal, long notice periods, renewal increases without a cap, or no export of your lists.
- Children's rules that need logins. If your library does not use patron logins on children's computers, rules that depend on them will not work.
- All or nothing. No way to start on one branch or one network before the whole system moves.
How to test before you commit
A demo shows a vendor's best case. A test on your own network shows your case. Run the filter on one branch or one network on the normal monthly plan, with staff testing first, and decide with numbers.
- Choose where. In a single library, start with one network, such as the staff network or the public PCs. In a system, choose one busy branch with a children's area and one small branch. Between them you meet most of what the rest will meet.
- Keep the old filter running elsewhere. If CIPA applies, the library's computers must stay filtered during the test. Move one network at a time from the old filter to the new one, with no gap in between.
- Test on one staff computer first. Point a single staff computer at the new filter and run the test list below before any patron sees a change.
- Switch the test network. Make the change before opening or in a quiet hour, with the person who can change the router at hand. Write down the old setting.
- Run normal opening hours. Give it enough time to see a few busy days, an after-school rush and a weekend.
- Count, then decide. Use the measures below, ask desk staff, and take a short summary to the director or board.
A test list for library networks
| Test | Where | Pass looks like |
|---|---|---|
| A site in a CIPA category | Public PC and a phone on patron Wi-Fi | Blocked. On encrypted sites a browser warning is normal. |
| A VPN or proxy website | Public PC and patron Wi-Fi | Blocked, including during an adult disable. |
| Your catalog, e-book and database services | Public PC, staff PC and Wi-Fi | Open, including sign-in pages. |
| Job, government, tax and benefits sites | Public PC | Open. |
| Health, sex education and support services | Adult public PC | Open, unless your policy says otherwise. |
| Children's rules | A children's computer | Stricter categories apply, safe search is forced, no adult disable. |
| Adult disable | Adult public PC, run by desk staff | Works in under a minute and ends on time by itself. |
| Always-allow | Staff add a blocked site | The site opens within minutes. |
| Browser secure DNS switched on | A public PC | Still filtered. |
| Records | The dashboard | Your tests appear with time and decision, and no patron names. |
What to measure during the test
- Unblock requests at the desk, and how long each took to close.
- Sites staff added to the always-allow list, and whether they belong in every branch.
- Complaints from patrons, in both directions: too much blocked, or something that should have been blocked.
- Weekly staff time on filter tasks.
- Whether the reports answer the board's questions without extra work.
If the test fails, set the router back to its old setting. Because the old filter is still in place, the network stays filtered. That is why the old filter keeps running until you decide.
How our hosted filter fits these requirements
Our hosted CIPA filter is a DNS filter that we run. You enter two filter addresses on the router or firewall, and every device on that network is filtered. Here is how it answers each requirement above.
| Requirement | How it works in our hosted filter |
|---|---|
| Adult disabling | Staff open the staff page on any phone or computer, enter the branch PIN and choose 15, 30 or 60 minutes. Adult content opens for that network, VPN and proxy sites stay blocked, and the filter switches back on by itself. A bypass for one PC only, ending at log-off, is set up on request. Patron self-unblock lets adults open a site themselves on adult computers. |
| Children's areas | A children's profile adds categories, forces SafeSearch and turns on YouTube Restricted Mode. Children's computers reach it through a separate network, an encrypted link set once on each PC, or the firewall. We suggest registering the children's area as its own network with no bypass. |
| Privacy | The filter sees which websites devices look up, not who uses a device. The staff bypass log records when the PIN was used and for how long, not what the adult read. Only the accounts you set up see the activity log, and we look only when you ask for help. |
| Patron Wi-Fi | Every device that joins a filtered network is covered with nothing installed. Public encrypted DNS services and browser settings that skip the network filter are blocked by default. On a blocked encrypted site the browser shows a warning instead of the site. |
| Unblock requests | Sites on the always-allow list beat any category. Changes apply within seconds, although some browsers keep an old answer for about a minute. Our website check shows how any site is categorized. Tell us about a wrong category and we look at it. |
| Over-blocking | The CIPA preset blocks Adult and VPN, Proxy and Anonymizers. Lingerie and swimsuits is optional and off by default. Gambling, weapons and other categories are added only where your policy asks. Category lists are reviewed so common library, government and education sites are not caught by the preset. |
| Board reporting | Activity and trends per site, a searchable log with spreadsheet export, a printable report and policy record, the staff bypass log and a monthly email. Weathervane adds a monthly board report: $79 a month per library, or $149 a month for a whole system. |
| Branches and staff | One console, with each branch keeping its own categories, lists and staff PIN. Staff networks can have their own profile. |
| Lent devices | Each device gets a private encrypted link with the same rules as your network: $0.10 per device a month or $1 a year, minimum 25 devices. |
| Price and terms | $99 a month per site, or $990 a year. Monthly plans can be cancelled at any time. Systems get a written quote within one business day. |
What it does not do
- A DNS filter decides by website, not by single page or video.
- It is a filter, not a monitoring or classroom screen tool.
- It needs a router or firewall where you can set the DNS servers, ideally with a fixed public IP address. Where that is not possible, devices can use a private encrypted link instead.
Full details: how the hosted filter works. Costs for one library and for a system: how much library web filtering costs.
Printable checklist
Tick what each product meets. Print one copy per vendor and attach their written answers.
Law and policy
Adults
Children's area
Privacy
Wi-Fi and devices
Unblocks and accuracy
Reporting
Contract and exit
Test results
Questions about choosing a library filter
How is choosing a filter for a library different from choosing one for a school?
A school filters students who usually sign in, on devices the school manages. A library serves adults, teenagers and young children at the same time, mostly without a login, on public PCs and on their own phones. Adults can ask for the filter to be disabled for lawful purposes, the children's area needs its own rules, and patron privacy weighs more. Those needs should shape the shortlist.
Does CIPA require a library to monitor or log what patrons do?
No. In its 2001 CIPA order the FCC said that CIPA does not require the tracking of internet use by any identifiable minor or adult user. USAC lists monitoring the online activities of minors as a policy requirement for schools, not for libraries. Keep only the records your policy and your state law call for.
Do staff computers need to be filtered?
Yes, if CIPA applies to your library. The certification covers a technology protection measure on any of the library's computers with internet access. Staff computers can have lighter rules, and an authorized person can disable the filter for an adult's lawful work.
Can adults ask for the filter to be disabled?
Yes. CIPA lets an administrator, supervisor or other person authorized by the library disable the technology protection measure during use by an adult, to enable access for bona fide research or other lawful purposes. USAC gives a sign-in page where the adult affirms that purpose as one example. The FCC left the details of the procedure to local communities.
Can we filter patron phones without installing anything on them?
Yes, with a filter that works at the network. With our hosted filter you change the DNS setting on the router, and every device that joins the network is filtered, including patron phones and laptops on the Wi-Fi.
Who decides what is inappropriate for minors?
The library, the library board or the other authority responsible for the library. CIPA says no federal agency may set the criteria for that decision. Write the decision into your internet safety policy.
How should we test a filter before we commit?
Run it on one branch or one network on the normal monthly plan, with staff testing first. Use a written test list, run it through normal opening hours, and count desk requests and wrongly blocked sites. Then decide with those numbers. Our monthly plans can be cancelled at any time.
Will a filter make us CIPA compliant?
A filter covers the technology part. The internet safety policy, the public notice and hearing or meeting, and the way you handle adult requests remain the library's responsibility.
Sources
- 47 U.S.C. 254(h)(6), (h)(7) and (l): library certifications, adult disabling, definitions and local determination of what is inappropriate for minors: govinfo.gov
- 20 U.S.C. 9134(f), internet safety condition on LSTA funds: govinfo.gov
- FCC, Report and Order on the Children's Internet Protection Act, FCC 01-120, released 5 April 2001, paragraph 6 on tracking and paragraph 53 on disabling: docs.fcc.gov/public/attachments/FCC-01-120A1.pdf
- USAC, CIPA: requirements, the library sign-in example, the school-only monitoring element, audit documentation and the 10-year retention rule: usac.org/e-rate/applicant-process/starting-services/cipa/
Checked on 2 November 2026. This guide is general information, not legal advice.
Test it on one branch first
Start one library on the monthly plan from $99 a month per site, cancel any time. For a library system, get a written quote within one business day.