Take control of Android app permissions on a per-app basis with XPrivacy

Android app permission requests are getting out of control. More and more apps want access to your data, your location and other identifiable and highly valuable information. Fortunately, if you have rooted your phone or tablet, you can bring permissions under control.

In this tutorial we’ll show you:

  • Why you need to know about Android app permissions
  • How to install and set up XPrivacy
  • Three ways to block or control permissions

What are app permissions?

Whenever you install an Android app you’ll be shown a list of all the permissions it requires. A permission enables the app to access a part of your phone—it could be a specific hardware feature like the camera or GPS, or it could be your data such as your address book or social networking accounts.

Lots of permissions

In most cases this is fine. A web browser obviously needs permission to access the internet; an image editor needs read and write access to your internal storage so that it can open and save the images you’re working with; a weather apps needs to know your location.

Yet often it isn’t clear what permissions are for, and why a particular app needs them. And the problem is, there’s nothing you can do about it.

When you’re shown the list of permissions before you install an app you can even accept them all, or cancel the installation. You cannot reject permissions on a case by case basis.


Signs are that there will be some level of permissions control in Android L, but many existing devices won’t be updated to that version of the OS.

How to set up XPrivacy

The alternative, then, is to take the root option. With the app XPrivacy you can block specific permissions entirely, for only certain apps, or on case by case basis whenever an app tries to use them.

Best of all, it doesn’t break the functionality of apps, because in many cases instead of simply blocking or ignoring a permission request it returns either blank or fake data so that the app thinks the request has been granted.

Of course, if you block internet access or camera access, or other hardware features, then this may prevent an app from running if that function is essential to the app.

XPrivacy is an incredibly powerful app that enables you to take control of your phone, your data and your privacy.

To use XPrivacy you need:

Install XPrivacy Installer and launch the app. You’ll be prompted to check that your device is rooted—when the grant root privileges box opens tick the Grant box.

Grant xprivacy

Next, you’ll need to tick the box labelled I have made a full backup. It’s a good idea to make that backup before you proceed, by the way.

Ensure you’ve enabled Unknown sources, and tick that box.

Now you’ll see the Xposed check list. You should already have Xposed installed, so that will be checked already. Now tick I have enabled Xposed.

Finally, tap the Download/install Xprivacy button. Launch the Xposed Installer when prompted, swipe to Versions and tap Download. Complete the installation and reboot your phone.

Install xprivacy

Blocking permissions with XPrivacy

Launch XPrivacy from the app drawer. It will do a quick scan of your phone and list all of the apps installed. By default it will be filtered to show only the user-installed apps, and not the system ones. There’s no reason to change this, as restricting permissions for built-in apps can cause problems.

If an app’s name is listed in bold italic text that means the app has requested use of a permission.

For more information on an app tap its icon. You’ll see every Android permission listed—the ones with a green key icon are the permissions that this app wants to use; if they have a yellow warning icon next to them it shows the app has recently used this permission.

Block a specific permission

There are three main approaches to controlling permissions in XPrivacy. In all instances an app will need to be closed and restarted for the changes to take effect.

First is to block or control a single permission across all apps.

Tap the filter permissions drop down and pick a permission you want to control. For example, Contacts.

Xprivacy specific

You’ll now see all the apps installed that have permission to access your Contacts. If you want to prevent an app from having this permission tap the box to the right of it. Next time the app wants to access your address book it will be sent a empty list instead of your actual addresses.

Work through the key permissions you want to restrict, adding as many apps as you need.

Xprivacy contacts

This method is perfect if you simply want to prevent access to certain features or functions, such as your address book or location for privacy reasons, or to prevent certain apps from going online.

Block all permissions for an app

The next method for controlling permissions is to block them all for a specific app.

Select All from the permissions drop down again to view all your apps.

Alongside each app are two boxes. Tapping the left-most one will selectively block all permissions for that app. It does it selectively as some permissions are not safe to block, but the important ones will be controlled.

Xprivacy block

Tap the app’s icon for more information on what exactly has been blocked, and deselect any permissions you want to allow.

If you untick the block all permissions box a question mark will appear in the right-most box. This means you will be prompted each time the app tries to use a permission. Which leads us to the final method.

Xpriavcy question

Prompt for each permission request

By ticking the right-most box next to an app you will be prompted each time an app wants to use a permission.

This sounds like the best option, but in fact for a while you will be overloaded by prompt requests each time you launch an app.

By default your choice will be remembered so you’ll only be prompted once for each app.

Xprivacy prompt

Alternatively you can tap Expert mode for more options. Here you can enable your choice to be allowed for only 15 seconds, which means you will be prompted next time the permission is used by that app.

Note that if you deny permission it may have adverse effects on how the app functions, although there will be no warning that it is your XPrivacy setting that is causing the problem. If an app starts behaving in expected ways, or stops working, you should always clear your XPrivacy settings for that app when you try to solve the problem.

Also note that when you’re prompted about permissions, the ones with a red background should always be allowed, as these are vital to the functioning of the app.

Xprivacy red

XPrivacy templates and more

By default XPrivacy will apply a template to all new apps you install, which means you will prompted to grant or deny permission requests the first time you launch the app.

You can also set up your own custom templates through the menu option. These templates can then be applied to any app—open the app by tapping the icon from the main XPrivacy screen, then select Apply template from the menu.

In order for XPrivacy to continue working you will need to keep it and Xposed installed and activated at all times. If you uninstall either, or unroot your phone, the permissions controls will no longer apply.

Android Tips and Hacks