In short
With the manufacturers' built-in tools: Screen Time and Family Sharing on iPhone, Google Family Link on Android. Both are free, limit times and apps, filter content, require your approval for purchases and show you what the child uses. The prerequisite is a separate child account, not your own. More important than the technology is the agreement with the child, or the lock becomes a daily fight.
First: a separate account for the child
The most common mistake: the child gets the phone with a parent's account. Then it sees your e-mails, buys with your card, and no parental control applies because the system sees an adult. Create a child account, at Apple via Family Sharing, at Google via Family Link. The date of birth is asked for, and from it the age limits for apps, films and content follow automatically.
iPhone: Screen Time and Family Sharing
On your iPhone under Settings, Family, add the child. It then appears under Screen Time on your device, and everything else you set remotely: a downtime in which only phone and allowed apps work (say 8 pm to 7 am), time limits per app category (games one hour, social networks half an hour), communication limits for contacts, and under Restrictions the age ratings, purchases with approval and the web filter. The Screen Time passcode must not be the child's unlock code and not the year of birth.
Android: Google Family Link
Install Family Link on your phone, create or link the child account, then set up the child's phone with this account. After that you control from your phone: daily time limit, bedtime, which apps may be installed (every installation comes to you as a request), filters for Play Store, Chrome and YouTube, and the location if wanted. Samsung phones additionally have their own Kids Mode for younger children that shows only selected apps.
What parental controls cannot do
They do not read messages in WhatsApp, Snapchat or TikTok, and they do not apply on a friend's phone. They filter websites, but not the content inside an app. For YouTube there is YouTube Kids or Restricted Mode, for search there is SafeSearch. For the home Wi-Fi most routers offer their own child profiles, on a FRITZ!Box they are called access profiles: with them, the internet for the child's phone ends at 9 pm even if something was changed on the phone itself.
The rule has to hold at home
A lock the child does not understand gets circumvented or fought. Better: agree on times and rules together, write them down, and use the technology only as a reminder. Independent guidance on age and usage time comes from klicksafe.de and schau-hin.info, both backed by public bodies. A media usage agreement that both sign sounds bureaucratic and works better than any app in many families.