Skip to main content
Use this topic to check and resolve privacy and permissions issues in your title. The XBOX Privacy service protects users by respecting their preferences and providing the social experiences they want. The Privacy service supports permission checking, muting users, and avoiding users by using XBOX services API (XSAPI) and XBOX services REST endpoints. For more information, see XSAPI Overview.
You can’t retrieve or set a user’s privacy settings with the Privacy service.

​
Permission checks

Permission checks are the primary capability that are provided by the Privacy service. These checks function by determining whether a user can perform an action with another user, or set of users. For example, if you want to know if a user can communicate with a target, the Privacy service bases its answer on a range of relevant criteria including the following scenarios.
  • Do both users’ settings permit this scenario?
  • What is the relationship between the users?
  • Is the actor on the Avoid list of the target?
XBOX Privacy Service supports cross-network communication permission checks. XBOX users can decide whether to communicate with friends on other networks (crossNetworkFriends) or everyone on those networks (crossNetworkUsers). The privacy service enables titles to verify whether crossNetworkUsers or crossNetworkFriends can communicate with the user via the following permission checks CommunicateUsingText, CommunicateUsingVideo, CommunicateUsingVoice.
Cross-network communication is the only cross-network scenario that privacy service permissions support.
For more information, see XblPrivacyCheckPermissionAsync and GET (/users/{requestorId}/permission/validate).

​
When to check permissions

If your title uses its own services, check permissions at the beginning of a session and when a new player joins the session. For user-initiated actions outside a session, check permissions before you show the other player’s data and before you perform the action. If a permission check fails, for example because XBOX services can’t be reached, block the requested action and fail gracefully. Treat a failed check the same way as a check that returns a result that isn’t allowed. To check permissions for players on other networks, pass XblAnonymousUserType::CrossNetworkUser or XblAnonymousUserType::CrossNetworkFriend to XblPrivacyCheckPermissionForAnonymousUserAsync or XblPrivacyBatchCheckPermissionAsync. If your title offers communication between XBOX network players and players on other networks, let players mute any player from another network for the duration of the session. User-to-user permission checks aren’t recommended in scenarios that involve large numbers of players, such as global chat or very large sessions and events. In these scenarios, check the communications privilege and each player’s block list at a regular cadence, such as hourly. If your title uses Game Chat 2, Game Chat 2 enforces privilege and privacy restrictions for the voice and text chat that it carries. For more information, see Using the Game Chat 2 C++ API. For the full requirements and test cases, see XR-015: Managing Player Communication and XR-045: XBOX network and Account Privileges.

​
Mute list

Your title can retrieve a user’s Mute list with the Privacy service. A Mute list specifies up to 250 users that the list owner doesn’t want to hear from via voice communication.
The Mute list controls voice communication, but it doesn’t affect text communication.
By default, all relevant permission checks incorporate Mute lists. This means that you don’t have to run extra checks for the Mute list in addition to checking other permissions. For example, if you want to know if a user can voice-chat with another user, the Privacy service checks the user’s Mute list as part of the permission check. Your code doesn’t need to also check the Mute list. However, you might find some scenarios where it’s helpful to retrieve a Mute list.
Games aren’t allowed to add people to a user’s Mute list.
For more information, see XblPrivacyGetMuteListAsync and GET (/users/{ownerId}/people/mute). To be notified when the Mute list changes instead of polling, register a handler with XblPrivacyAddMuteListChangedHandler. For more information, see Change notifications for the Mute and Avoid lists.

​
Avoid list

Your title can also retrieve a user’s Avoid list with the Privacy service. An avoid list holds up to 1,000 XBOX users that the owner has blocked to prevent communication in any form, such as voice, text, game invites, or club invites. Retrieving the Avoid list can be valuable, but checking the Avoid list is also part of all relevant permission checks. For example, if you want to know if a user can send a text message to another user, the Privacy service consults the Avoid list as part of the permission check. Your code doesn’t need to also check the Avoid list.
Games aren’t allowed to add people to a user’s Avoid list.
For more information, see XblPrivacyGetAvoidListAsync and GET (/users/{ownerId}/people/avoid). To be notified when the Avoid list changes, register a handler with XblPrivacyAddBlockListChangedHandler. The change-notification APIs call the Avoid list the block list.

​
Change notifications for the Mute and Avoid lists

The change-notification handlers report only changes to a list, not the full list. Each notification has a change type of XblPrivacyListChangeType::Added or XblPrivacyListChangeType::Removed and an array of the XBOX user IDs (XUIDs) that changed. To get the full lists, call XblPrivacyGetMuteListAsync and XblPrivacyGetAvoidListAsync. Keep the following in mind when you use the handlers:
  • The XUID array and the other event arguments are valid only during the callback. Copy any values that you need to keep.
  • The add functions return 0 if they can’t register the handler. Save the returned token so that you can remove the handler later.
  • The notifications are delivered through real-time activity (RTA). Register a handler with XblRealTimeActivityAddResyncHandler. A resync notification means that data might have been lost, so get the full lists again when you receive one.
  • Before you close the XblContextHandle, remove each handler that you registered by calling XblPrivacyRemoveMuteListChangedHandler or XblPrivacyRemoveBlockListChangedHandler.
Change notifications don’t replace permission checks. Continue to check permissions as described in When to check permissions.

​
See also

XBOX services overview Getting started with XBOX services APIs XR-015: Managing Player Communication XR-045: XBOX network and Account Privileges
Last modified on October 29, 2026