> ## Documentation Index > Fetch the complete documentation index at: https://docs.xbox.com/llms.txt > Use this file to discover all available pages before exploring further. # Privacy and permissions overview > Use the XBOX Privacy service and XSAPI to run permission checks for chat, video, and cross-network play, and to respect mute and avoid list preferences. Use this topic to check and resolve privacy and permissions issues in your title. The XBOX Privacy service protects users by respecting their preferences and providing the social experiences they want. The Privacy service supports permission checking, muting users, and avoiding users by using XBOX services API (XSAPI) and XBOX services REST endpoints. For more information, see [XSAPI Overview](https://docs.xbox.com/services/xbox-services/fundamentals/xbox-services-api/live-introduction-to-xbox-live-apis.md). > [!NOTE] > > You can't retrieve or set a user's privacy settings with the Privacy service. ## Permission checks Permission checks are the primary capability that are provided by the Privacy service. These checks function by determining whether a user can perform an action with another user, or set of users. For example, if you want to know if a user can communicate with a target, the Privacy service bases its answer on a range of relevant criteria including the following scenarios. * Do both users' settings permit this scenario? * What is the relationship between the users? * Is the actor on the Avoid list of the target? XBOX Privacy Service supports cross-network communication permission checks. XBOX users can decide whether to communicate with friends on other networks (**crossNetworkFriends**) or everyone on those networks (**crossNetworkUsers**). The privacy service enables titles to verify whether **crossNetworkUsers** or **crossNetworkFriends** can communicate with the user via the following permission checks CommunicateUsingText, CommunicateUsingVideo, CommunicateUsingVoice. > [!NOTE] > > Cross-network communication is the only cross-network scenario that privacy service permissions support. For more information, see [XblPrivacyCheckPermissionAsync](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacycheckpermissionasync.md) and [`GET (/users/{requestorId}/permission/validate)`](https://docs.xbox.com/reference/live/rest/uri/privacy/uri-privacyusersrequestoridpermissionvalidateget). ## When to check permissions If your title uses its own services, check permissions at the beginning of a session and when a new player joins the session. For user-initiated actions outside a session, check permissions before you show the other player's data and before you perform the action. If a permission check fails, for example because XBOX services can't be reached, block the requested action and fail gracefully. Treat a failed check the same way as a check that returns a result that isn't allowed. To check permissions for players on other networks, pass `XblAnonymousUserType::CrossNetworkUser` or `XblAnonymousUserType::CrossNetworkFriend` to [XblPrivacyCheckPermissionForAnonymousUserAsync](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacycheckpermissionforanonymoususerasync.md) or [XblPrivacyBatchCheckPermissionAsync](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacybatchcheckpermissionasync.md). If your title offers communication between XBOX network players and players on other networks, let players mute any player from another network for the duration of the session. User-to-user permission checks aren't recommended in scenarios that involve large numbers of players, such as global chat or very large sessions and events. In these scenarios, check the communications privilege and each player's block list at a regular cadence, such as hourly. If your title uses Game Chat 2, Game Chat 2 enforces privilege and privacy restrictions for the voice and text chat that it carries. For more information, see [Using the Game Chat 2 C++ API](https://docs.xbox.com/services/xbox-services/multiplayer/chat/game-chat2/using-game-chat-2.md). For the full requirements and test cases, see [XR-015: Managing Player Communication](https://docs.xbox.com/publishing/certification/xr/xr-015.md) and [XR-045: XBOX network and Account Privileges](https://docs.xbox.com/publishing/certification/xr/xr-045.md). ## Mute list Your title can retrieve a user's Mute list with the Privacy service. A Mute list specifies up to 250 users that the list owner doesn't want to hear from via voice communication. > [!NOTE] > > The Mute list controls voice communication, but it doesn't affect text communication. By default, all relevant permission checks incorporate Mute lists. This means that you don't have to run extra checks for the Mute list in addition to checking other permissions. For example, if you want to know if a user can voice-chat with another user, the Privacy service checks the user's Mute list as part of the permission check. Your code doesn't need to also check the Mute list. However, you might find some scenarios where it's helpful to retrieve a Mute list. > [!NOTE] > > Games aren't allowed to add people to a user's Mute list. For more information, see [XblPrivacyGetMuteListAsync](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacygetmutelistasync.md) and [`GET (/users/{ownerId}/people/mute)`](https://docs.xbox.com/reference/live/rest/uri/privacy/uri-privacyusersowneridpeoplemuteget). To be notified when the Mute list changes instead of polling, register a handler with [XblPrivacyAddMuteListChangedHandler](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacyaddmutelistchangedhandler.md). For more information, see [Change notifications for the Mute and Avoid lists](#change-notifications-for-the-mute-and-avoid-lists). ## Avoid list Your title can also retrieve a user's Avoid list with the Privacy service. An avoid list holds up to 1,000 XBOX users that the owner has blocked to prevent communication in any form, such as voice, text, game invites, or club invites. Retrieving the Avoid list can be valuable, but checking the Avoid list is also part of all relevant permission checks. For example, if you want to know if a user can send a text message to another user, the Privacy service consults the Avoid list as part of the permission check. Your code doesn't need to also check the Avoid list. > [!NOTE] > > Games aren't allowed to add people to a user's Avoid list. For more information, see [XblPrivacyGetAvoidListAsync](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacygetavoidlistasync.md) and [`GET (/users/{ownerId}/people/avoid)`](https://docs.xbox.com/reference/live/rest/uri/privacy/uri-privacyusersxuidpeopleavoidget). To be notified when the Avoid list changes, register a handler with [XblPrivacyAddBlockListChangedHandler](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacyaddblocklistchangedhandler.md). The change-notification APIs call the Avoid list the block list. ## Change notifications for the Mute and Avoid lists The change-notification handlers report only changes to a list, not the full list. Each notification has a change type of `XblPrivacyListChangeType::Added` or `XblPrivacyListChangeType::Removed` and an array of the XBOX user IDs (XUIDs) that changed. To get the full lists, call `XblPrivacyGetMuteListAsync` and `XblPrivacyGetAvoidListAsync`. Keep the following in mind when you use the handlers: * The XUID array and the other event arguments are valid only during the callback. Copy any values that you need to keep. * The add functions return 0 if they can't register the handler. Save the returned token so that you can remove the handler later. * The notifications are delivered through real-time activity (RTA). Register a handler with [XblRealTimeActivityAddResyncHandler](https://docs.xbox.com/reference/live/xsapi-c/real_time_activity_c/functions/xblrealtimeactivityaddresynchandler.md). A resync notification means that data might have been lost, so get the full lists again when you receive one. * Before you close the `XblContextHandle`, remove each handler that you registered by calling [XblPrivacyRemoveMuteListChangedHandler](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacyremovemutelistchangedhandler.md) or [XblPrivacyRemoveBlockListChangedHandler](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacyremoveblocklistchangedhandler.md). Change notifications don't replace permission checks. Continue to check permissions as described in [When to check permissions](#when-to-check-permissions). ## See also [XBOX services overview](https://docs.xbox.com/services/xbox-services/fundamentals/live-xbl-overview.md) [Getting started with XBOX services APIs](https://docs.xbox.com/services/xbox-services/fundamentals/xbox-services-api/live-gs-xbl-apis.md) [XR-015: Managing Player Communication](https://docs.xbox.com/publishing/certification/xr/xr-015.md) [XR-045: XBOX network and Account Privileges](https://docs.xbox.com/publishing/certification/xr/xr-045.md) ## Related topics - [Privacy and permissions (contents)](https://docs.xbox.com/services/xbox-services/fundamentals/identity/privacy/live-privacy-permissions-nav.md) - [Certification Tested XBOX Requirements for XBOX Games](https://docs.xbox.com/publishing/certification/console-cert-tested-requirements.md) - [XBOX Requirements for XBOX Games](https://docs.xbox.com/publishing/certification/xbox-requirements.md) - [XR-015 Managing Player Communication](https://docs.xbox.com/publishing/certification/xr/xr-015.md) - [XblPrivacyCheckPermissionAsync](https://docs.xbox.com/reference/live/xsapi-c/privacy_c/functions/xblprivacycheckpermissionasync.md)