XDA spent last winter picking apart Windows 11 and found the OS was quietly forwarding keystroke samples to Microsoft unless a buried “improve inking and typing” toggle got switched off. The story landed hard because most people had no idea the setting existed, let alone that it was on. Android has the same problem, and in some ways it is worse. Every preinstalled app on a fresh phone pings home the moment it wakes up. Push services, crash reporters, ad SDKs bundled into the keyboard, the launcher, and the calculator all leak metadata before you have opened a single thing. The seven best apps for controlling Android telemetry in 2026 show you that traffic in real time and let you cut off the domains you do not recognize, without rooting the device or trusting a third-party VPN server with your DNS.
What to look for in an Android telemetry blocker
Five things separate a serious tool from a placebo.
No root required. Rooting a stock phone in 2026 usually breaks banking apps, Google Wallet, and Netflix DRM. Every pick below except AFWall+ works on an unmodified device.
Local VPN loopback. The best-behaved firewalls route traffic through a local VPN tunnel that never leaves the phone. Nothing goes to a third-party server, nothing gets logged, and the tunnel closes when you disable the app.
Per-app rules. Blanket blocklists miss the point. You want to say “the weather widget cannot talk to Facebook’s ad domain” while leaving the browser alone.
Live traffic log. A firewall that only shows aggregate stats is guessing. Look for a running log of hostnames, ports, and destinations, ideally with timestamps.
Open source. A privacy tool you cannot audit is a leap of faith. Six of the seven picks below publish their code, and the seventh is a reputable paid app with independent reviews.
Quick comparison
| App | Best for | Free | Root required | Open source | Platforms |
|---|---|---|---|---|---|
| NetGuard | Overall no-root firewall | Yes (pro paid) | No | Yes | Android |
| RethinkDNS + Firewall | Combined DNS and firewall | Yes | No | Yes | Android |
| AdGuard | DNS-level tracker blocking | Free system-wide (paid app) | No | Partial | Android |
| Blokada | Transparent DNS filter | Yes | No | Yes | Android |
| TrackerControl | Per-tracker granularity | Yes | No | Yes | Android |
| PCAPdroid | Forensic packet capture | Yes | No | Yes | Android |
| AFWall+ | Root iptables control | Yes | Yes | Yes | Android |
1. NetGuard — best overall
NetGuard is the default recommendation for a reason. It runs a local VPN loopback, presents a clean per-app allow/deny list, and lets you toggle Wi-Fi and mobile data independently for every installed app. The free version handles the firewall duties. The pro unlock adds a live traffic log, per-address rules, and the ability to block specific hostnames within an app instead of pulling the plug entirely. Setup is one screen: install, grant VPN permission, tap the apps you want to silence. The developer, Marcel Bokhorst, is a Dutch security researcher who also maintains FairEmail and has been shipping updates on a monthly cadence for the better part of a decade.
Where it falls short: the free tier hides the traffic log behind the pro unlock, which makes debugging blocked apps harder if you have not paid. There is also no built-in blocklist, so you get raw control rather than a curated experience.
Pricing: free with in-app purchases for pro features (roughly the cost of a coffee, one-time).
Platforms: Android.
Download: Aptoide | Google Play | F-Droid
Bottom line: start here unless you already know you need something more specialised.
2. RethinkDNS + Firewall — best combined DNS and firewall
RethinkDNS bundles two tools most people install separately. On one side, it is an encrypted DNS resolver that supports DoH, DoT, and DNSCrypt with a rotating list of upstreams. On the other, it is a per-app firewall in the NetGuard mould. The magic is the join: you can write a rule that says “this app can only reach domains on this blocklist” and see the DNS lookups it makes in real time. The blocklists are community-curated and include the usual suspects (EasyList, Peter Lowe, StevenBlack) plus categories for telemetry, notification pings, and cryptojacking. Everything runs inside a local VPN tunnel with no traffic leaving the device.
Where it falls short: the interface tries to do a lot and the learning curve is steeper than NetGuard’s. First-time users can spend an hour finding the right combination of blocklists.
Pricing: free and open source, no paid tier.
Platforms: Android.
Download: Aptoide | Google Play | F-Droid
Bottom line: pick this if you want DNS and firewall in one app and are willing to spend an evening configuring it.
3. AdGuard — best DNS-level tracker blocking
AdGuard has been the polish leader in this category for years. The full Android app is paid and installs system-wide filtering through a local VPN loopback, with pre-tuned lists for ads, trackers, phishing, and social widgets. There is also a free companion called AdGuard DNS that changes only your device’s DNS resolver to AdGuard’s filtered servers, which strips a large slice of tracker traffic without touching per-app rules. Both are configured through the same clean interface with sensible defaults, an activity log, and a stats page that shows you how many requests were blocked in the last day.
Where it falls short: the full app was pulled from Google Play years ago because it does system-level ad filtering, so you install it directly from AdGuard or through F-Droid mirrors. Only the DNS client is on Play.
Pricing: the DNS client is free; the full firewall app costs a modest annual subscription with a lifetime option.
Platforms: Android.
Download: Aptoide | Google Play (DNS client only)
Bottom line: pick this if you want the least-friction paid option and do not mind sideloading the main app.
4. Blokada — best transparent DNS filter
Blokada is the low-fuss pick. It runs as a local VPN loopback, filters DNS against community lists, and gets out of the way. There is no per-app firewall and no packet inspection, which is exactly the point: you install it, pick a blocklist bundle, and forget it exists. The v5 codebase is fully open source and the developers publish quarterly transparency reports on funding and telemetry. Blokada Plus adds an optional real VPN routed through the team’s own servers if you want that, but the free tier does everything the average person needs.
Where it falls short: DNS filtering only. If an app hardcodes an IP address for its telemetry endpoint, Blokada cannot stop it. That is uncommon but not zero.
Pricing: free and open source; Blokada Plus VPN is a paid monthly subscription.
Platforms: Android.
Download: Aptoide | Google Play | F-Droid
Bottom line: pick this if you want something you can hand to a non-technical friend and know it will not confuse them.
5. TrackerControl — best per-tracker granularity
TrackerControl comes at the problem from a different angle. Instead of a blanket domain blocklist, it identifies specific tracker SDKs inside each installed app using the Exodus Privacy database, then lets you allow or block individual trackers per app. So a weather app that ships with Google Analytics, Facebook SDK, and Flurry becomes three separate switches. The app was born out of an academic research project at Oxford and it shows: the interface is more academic than commercial, but the data model is unique and genuinely useful when you want to understand what a specific app is doing rather than just cutting off the whole thing.
Where it falls short: the app is not on Google Play (Google’s policies rule out competing tracker tooling), so you install it from F-Droid or through Aptoide. The UI is dense and takes patience.
Pricing: free and open source.
Platforms: Android.
Bottom line: pick this when you want to know which tracker inside which app is calling home, tracker by tracker.
6. PCAPdroid — best forensic packet capture
PCAPdroid does what the name suggests: it captures raw packet data leaving your phone and writes it to a standard PCAP file you can open in Wireshark. There is a firewall mode too, but the real reason to install it is the forensic view. Suspect an app of leaking something? Run PCAPdroid, use the app for two minutes, then read exactly which hostnames were contacted, over which ports, with which certificates, and how much data left. It supports SNI decryption for HTTPS traffic (with a user-supplied CA cert) so you can see the destination hostnames of TLS connections without decrypting the payloads.
Where it falls short: this is a diagnostic tool, not a set-and-forget blocker. You use it when you have a specific question, then turn it off.
Pricing: free and open source with an optional paid mitmproxy add-on for full TLS decryption.
Platforms: Android.
Download: Aptoide | Google Play | F-Droid
Bottom line: pick this when a firewall tells you an app is chatty and you need to know what it is actually saying.
7. AFWall+ — best root iptables control
AFWall+ is the veteran of the category and the only pick here that requires root. It hooks into the Linux iptables kernel layer directly, which means it filters at a level nothing on the phone can bypass, including apps that ignore VPN loopbacks. If you are already running a rooted device (LineageOS, GrapheneOS with root, or a research phone), this is the strongest tool available. The interface is spartan and the rules are per-app allow lists split by Wi-Fi, mobile data, roaming, LAN, and VPN. You give an app zero access by default, then whitelist what it genuinely needs.
Where it falls short: you need root, which excludes the vast majority of users and breaks banking and DRM apps on a stock device. Setup requires more thought than a no-root firewall.
Pricing: free and open source, with a donation build that adds a few niceties.
Platforms: Android.
Bottom line: pick this only if you are already rooted and want kernel-level control.
How to pick
Match the app to how much time you want to spend.
If you have never used a firewall and want the safest starting point, install NetGuard. Free, one screen of setup, and the pro unlock is inexpensive when you decide you want the traffic log. It will get you most of the way.
If you want DNS filtering and a firewall in one app and do not mind a longer first session, install RethinkDNS + Firewall. It is the most capable free option once you learn its interface.
If you value polish and do not mind paying, install AdGuard. The DNS client is free and the full paid app is the smoothest experience in the category.
If you want set-and-forget for a family member who is not technical, install Blokada. Pick a blocklist, walk away.
If you want to audit specific apps rather than block domains, install TrackerControl for the tracker-level view and add PCAPdroid when you need to inspect actual traffic.
If your phone is already rooted, install AFWall+ on top of any of the above for the strongest possible enforcement.
Most people end up running two apps: one for continuous filtering (NetGuard or Blokada) and PCAPdroid on standby for when something feels off.
FAQ
Do these apps replace a VPN?
No. They use the local VPN slot on Android to intercept traffic, but the traffic still goes out over your normal connection. If you want to hide your IP from the sites you visit, you need a real VPN provider running alongside a DNS-based blocker like Blokada or AdGuard, not one of the firewalls that occupies the VPN slot itself.
Will these apps break banking or streaming?
Occasionally. Some banking apps refuse to run when a VPN slot is active because they cannot distinguish a local loopback from a real VPN. NetGuard, RethinkDNS, and Blokada all let you disable filtering for specific apps, which usually fixes it. AFWall+ needs root, which is a bigger compatibility problem for banking apps in 2026.
Can I run two of these at once?
Only one app can hold Android’s VPN slot at a time. So you can run NetGuard and PCAPdroid alternately, but not both live. AFWall+ is different because it uses iptables directly and does not need the VPN slot, so it stacks with a DNS-based filter cleanly on a rooted device.
Are the blocklists safe to trust?
The community lists shipped by RethinkDNS, Blokada, and AdGuard are the same ones used by Pi-hole and NextDNS. They are actively maintained and reviewed. False positives happen occasionally when a website reroutes login traffic through an ad domain, which is why every app here lets you whitelist a hostname in two taps.
How much battery do they use?
Modern versions of NetGuard, Blokada, and AdGuard use single-digit milliamp-hours per day in normal use. PCAPdroid is heavier when actively capturing but idle usage is negligible. AFWall+ has zero runtime cost because iptables rules are enforced in the kernel.
Do I need to root my phone?
No. Six of the seven apps above work on unmodified stock Android. AFWall+ is the only exception and it is only worth the trouble if you are already rooted for other reasons.
