Blocking Screen Recordings & Screenshots in Android

In many apps, what the user sees on the screen is sensitive. It could be a bank account balance, a private message, a digital ticket with a QR code, or premium video content. Allowing users to easily screenshot or record this content can lead to privacy violations, content piracy, and fraud.

As an Android developer, you have a simple but powerful tool at your disposal to prevent this: FLAG_SECURE. This guide will show you exactly how to use it, explain what it does, and discuss its limitations.

Why Block Screen Captures?

This isn't about being overly restrictive; it's about protecting the user and your content. Common use cases include:

• Banking & Finance Apps: Protecting account numbers, balances, and transaction histories.
• Healthcare Apps: Protecting sensitive personal health information (PHI).
• Streaming Apps: Preventing piracy of copyrighted video content (DRM).
• Ticketing & Coupon Apps: Preventing users from sharing or duplicating unique codes.
• Enterprise Apps: Protecting confidential company data.

The One-Liner Solution: `FLAG_SECURE`

The Android framework provides a window flag that tells the system to treat the content of the window as secure. This prevents it from appearing in screenshots, screen recordings, and on non-secure displays.

When this flag is active:

• A user trying to take a screenshot will see a black screen or a toast message saying, "Couldn't save screenshot."
• Screen recording apps will record a black screen instead of your app's UI.

How to Implement It

You can apply this flag programmatically in your Activity's onCreate method. This is the most common and recommended approach.

import android.os.Bundle
import android.view.WindowManager
import androidx.appcompat.app.AppCompatActivity

class SecureActivity : AppCompatActivity() {

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        
        // Add this line before setContentView
        window.setFlags(
            WindowManager.LayoutParams.FLAG_SECURE,
            WindowManager.LayoutParams.FLAG_SECURE
        )

        setContentView(R.layout.activity_secure)
    }
}

That's it! The entire window for SecureActivity is now protected. You can also add and clear the flag dynamically if you only want to protect the screen conditionally (e.g., only when sensitive data is visible).

// To add the flag dynamically
window.addFlags(WindowManager.LayoutParams.FLAG_SECURE)

// To remove the flag dynamically
window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)

Important Limitations and Considerations

However, you should be aware of its limitations:

• Rooted Devices: On a rooted device, a user with sufficient technical skill can use tools (like Xposed modules) to bypass this flag at the system level.
• Physical Capture: It cannot prevent a user from taking a picture of their screen with another camera.
• Accessibility Services: Malicious accessibility services could potentially read screen content before it's rendered, though this is a complex attack.
• ADB: In some older Android versions, it was possible to capture the screen via ADB, but this has been largely mitigated in modern OS versions.

Testing Your Implementation

Testing is simple:

1. Run your app on a physical device or emulator.
2. Navigate to the protected screen.
3. Try to take a screenshot (usually Power + Volume Down).
4. Try to use the built-in screen recorder.

You should see a black screen in the resulting image or video. This confirms your protection is active.

While no solution is 100% foolproof against a determined attacker with physical access to a rooted device, using FLAG_SECURE is an essential and easy-to-implement best practice. It provides a robust layer of protection that effectively safeguards user data and content in almost all real-world scenarios.