- Windows and telemetry-based apps. I do have a VM for a work VPN however.
- Google, except the school district forced an exception.
- Youtube, unless supervised on a shared anonymous tablet.
- Double-click and other advertising sites.
- Third-party cookies, and most third-party javascript.
- No giving out information to any site, make it up if required.
- Alexa etc, wife uses Siri.
As you can see, outside entities have forced a number of exceptions. Other additions:
- Screen time
- dnsmasq whitelist for kids