1. A first wireless end-user device comprising: a wireless modem to communicate wireless data with a network for one or more device service activities; and at least one processor implementing one or more agents to: designate the first wireless end-user device as subject to controls under a device group authorization from an authorized master wireless end-user device, receive via the wireless modem one or more protection management profiles from the master wireless end-user device, evaluate the current status of a plurality of device states for the first wireless end-user device, including a device location change state and a device user input/output method state, against corresponding settings in a given one of the protection management profiles, to determine a value for a match status to the plurality of devices states, for at least one determined value of the match status, perform one or more corresponding network activity management actions specified in the given one of the protection management profiles, the network activity management actions limiting at least a specified one of the device service activities, and for at least one other determined value of the match status, do not perform the one or more activity management actions.