Block an app on mobile data but not wifi, on Android

Last updated: 20 September 2026

You want one app — a game, TikTok, YouTube — to work at home on wifi and never touch your mobile data. Not "use less data". Not "warn me at 80%". Off on cellular, on at home, per app.

Android can nearly do this, and whether your phone can depends entirely on who made it. This page says what each kind of phone can do, what the free tools add, and where all of it stops — including where our own app stops, which is further than we would like.

If the question you actually came with was why not just use Google Family Link, that one has its own page — the short version is that Family Link has no per-app idea of the network at all, so this particular problem is not one it can solve.

The short answer

If you have a Xiaomi or an Oppo, stop reading after the next section — your phone already does this and you do not need an app.

If you have a Samsung, you can do the thing in the headline today, for free, and the rest of this page is about the two things you still cannot do.

If you have a Pixel, the built-in settings will not get you there at all.

First, check your own phone

The menu names move between versions. If the path below does not match what you see, open Settings, search for data usage, and follow what comes back — the feature is usually there under a different name rather than missing.

Samsung (One UI)

Settings → Apps → [the app] → Mobile data.

There you get separate switches for mobile data and wifi. Turn mobile data off and leave wifi on, and that app is now a wifi-only app. This is exactly the thing most people arrive looking for, and on a Samsung it is four taps and free.

What you cannot do here is turn both off. One UI will let an app be wifi-only or mobile-only, but not offline — there is no "block this app from the internet entirely". Samsung's own community forums have a long-running request thread about it.

Xiaomi, Redmi, POCO (MIUI / HyperOS)

Settings → Connection & sharing → Data usage → [the app].

Two toggles, mobile data and wifi, independently. Turn off either, or both. MIUI kept the full version of this feature when most others narrowed it.

Oppo, Realme, OnePlus (ColorOS)

Under Settings → Mobile network → Data usage → App network permissions (or close to it, depending on version). ColorOS also generally kept per-app wifi and mobile controls.

Pixel, Motorola, Nokia, and most stock Android

Settings → Network & internet → Internet → the gear beside your carrier → App data usage → [the app].

This is where it disappoints. What you get is Background data and Unrestricted data usage — and background data is not what you want. It stops the app fetching while you are not looking at it. Open the app and it will use mobile data normally. There is no per-app cellular switch on stock Android, and a Pixel cannot do the thing in the headline without help.

What actually happened to this feature

You will read that "Android 11 removed it". That is close but not quite right, and the difference matters when you are trying to work out what your next phone will do.

Android itself never offered a full per-app wifi/cellular block in stock settings. What existed — and still exists — is a manufacturer feature. Around Android 11 several of the big skins narrowed or dropped theirs, Samsung's among them; Xiaomi and Oppo kept theirs. So this is not a version you can check. It is a brand decision, it varies by model within a brand, and it can change under you in a software update.

That instability is the real problem with relying on built-in settings for this, and it is worth more than the feature itself: a setting your phone maker can remove in a Tuesday update is not something to build a household rule on.

The free answer: NetGuard

If your phone cannot do it, a firewall app can, and the one worth knowing is NetGuard — open source, no root required, on F-Droid and Play.

It gives you a list of every app with two switches each, Allow Wi-Fi and Allow Mobile. That is the feature, on any phone, including a Pixel. It is free, it is genuinely good, and for a lot of people reading this it is the end of the search.

How it works, because the mechanism explains its limits. Android will not let an ordinary app touch the firewall, so NetGuard registers itself as a VPN and routes the phone's traffic through itself locally. Nothing leaves your phone and no server is involved — it is a local loop that exists purely to get a look at the traffic.

Two consequences follow:

• You get one VPN slot and this uses it. Android does not allow VPN chaining, so while NetGuard is running you cannot also run an actual VPN. If your household uses one, you are choosing between them.
• Your child can turn it off. It is an app. It appears in the app list, it has a notification, and disabling a VPN is a couple of taps in Settings that any curious twelve-year-old finds within a week.

You can harden the second one — Android's Always-on VPN with Block connections without VPN, behind a screen-lock PIN your child does not have. That is a real improvement and for a younger child it may be enough. It is still not enforcement: it lives in the same Settings app your child uses every day, and it does not survive them factory-resetting the phone.

So NetGuard is the right answer to "how do I do this", and an incomplete answer to "how do I do this to somebody else's phone". Those are different questions, and most articles on this topic answer the first while their readers are asking the second.

The question underneath the question

Nearly everyone searching for this is a parent, and the honest version of the request is not how do I block this app on mobile data. It is how do I block this app on mobile data in a way my kid cannot undo.

Every free option above fails that second half. Not because the software is bad — NetGuard is better-built than most paid alternatives — but because Android draws a hard line: an app installed normally cannot stop the person holding the phone from removing it. That is a deliberate design decision and it is mostly a good one.

Android does have a way through that line. It is called Device Owner, it is the mechanism companies use to manage work phones, and it grants an app authority that the user of the device cannot revoke.

What Safeleaf does, and what it costs you

We make Safeleaf, which is a parental control app built on Device Owner. What it gives you over a firewall app:

• Per-app cellular and wifi control, separately — the feature this whole page is about, on any phone running Android 8.0 or later, regardless of who made it or whether they kept their own version.
• Rules your child cannot remove. No uninstall, no force-stop, no clearing data, no safe mode, no turning off a VPN.
• Unlocks that work with no signal. Fifteen minutes of something granted by showing a QR code, or by reading a ten-digit code down the phone. Neither phone needs internet.
• Both parents, equal authority, with a record of which one changed what. Built for families across two households.
• Calls and messages can never be blocked — not by a rule, not by a mistake, not by a bad unlock code.
• No account, and nothing we can read. The rules, the usage figures and the audit log stay on your phones. We do not operate a service that receives them, because we did not build one.

Now the cost, and it is a real one: Device Owner can only be granted on a fresh phone, at the setup wizard. Installing Safeleaf means factory-resetting the phone first.

That is not our rule and we cannot work around it — it is the price Android charges for authority the phone's user cannot revoke, and it is charged precisely so that this cannot be done to somebody's phone quietly. It is the same door work-phone management goes through.

Your child will also know it is there. Android displays a "managed by your organisation" notice and we are not able to hide it, nor would we want to. This is a tool for an arrangement you have made with your child. It is not a way to watch them secretly, and it is not built to be one.

So which one do you want

Your phone already does it (Xiaomi, Oppo, or a Samsung and you only need the cellular half). Use the built-in setting. Do not install anything. Be aware it may change in an update.

You need it on a Pixel, or you need to block both wifi and mobile, and your child is young enough not to go looking. NetGuard, optionally with always-on VPN behind a PIN. Free, open source, no reset.

Your child has already found the off switch, or you need the rule to hold across two households, or "they can just turn it off" is the reason the last three things you tried failed. That is what Safeleaf is for, and the factory reset is what buys it. Have a look and decide whether the trade is worth it — we would rather you worked that out now than after resetting a phone.

Safeleaf is built by n12n in New Brunswick. Questions go to n12n.can@proton.me, and we answer them ourselves. What we collect, which is nothing from the app, is in the privacy policy.