dnswhisperer

For a hardware-free option let me plug my little weekend project called DNS Whisperer: https://github.com/apankrat/dnswhisperer It's been quietly spinning on our mail server for a couple of years and it works just as you'd expect it to. Block ratio is around 50%, with no notable effects on browsing experience. It also blocks various in-game ads on the iOS devices. I update the blacklist now and then, may be once every 4-5 months if that, but it's largely maintenance-free.

Set up a DNS proxy, point your son's iPad at it, tail the log and then blacklist domains that serve these ads. Bonus, this can also be used to remove YouTube and other kinds of ads as well as all the phone-home "analytics" if that's your thing. -- Edit -- Some options: http://www.thekelleys.org.uk/dnsmasq/doc.html + ToDo's via Google https://github.com/apankrat/dnswhisperer or more generally https://github.com/search?utf8=&q=ad+blocking+dns There are also 3rd party services that provide this function. They have obvious privacy issues, but for a kid's iPad it might be an option.

I wrote a tiny DNS filtering daemon that does exactly the same - https://github.com/apankrat/dnswhisperer I've been using it routinely for past couple of months and it works really well. It blocks web ads, but it's blocks in-app ads and tracking as well. Tailing a log when launching an iPad game make for an interesting read. If anything slips through, just check the log, add the offender to the blacklist and restart the daemon.