# Users can block or mute other users

- **Pattern:** `ab-000500` (`app-store-review-blockers.content-moderation.block-mute-users`)
- **Severity:** medium
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000500
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000500)

## Why it matters

Apple's guideline 1.2 explicitly requires apps with user interaction features to offer users the ability to block abusive users. A direct messaging app, a commenting feature, or a following system without a block mechanism leaves users with no recourse against harassment. The reviewer will look for it, not find it, and reject. Beyond review compliance, a missing block feature has real safety consequences: users who cannot escape harassment churn immediately and leave negative reviews. The block relationship must be server-side — client-only blocks that reset on reinstall or across devices are not acceptable.

## Severity rationale

Medium because Apple guideline 1.2 mandates block/mute capability for any app with user-to-user interaction, with rejection as the direct consequence of omission.

## Remediation

Add a block action to user profiles and message threads, enforced server-side.

```tsx
// src/screens/UserProfileScreen.tsx
async function handleBlockUser(targetUserId: string) {
  await fetch('/api/users/block', {
    method: 'POST',
    body: JSON.stringify({ blocked_user_id: targetUserId }),
  });
  Alert.alert('User blocked', 'You will no longer see their content.');
  navigation.goBack();
}
```

In your API, filter blocked users from feed queries, message threads, and comment lists. Add a "Blocked Users" screen in Settings so users can review and unblock. Store the block relationship in a `blocked_users` table — never only in client state.

## Detection

- **ID:** `block-mute-users`
- **Severity:** `medium`
- **What to look for:** Count all relevant instances and enumerate each. Search for block and mute functionality: function names or component names containing `block`, `mute`, `hide-user`, `blockUser`, `muteUser`. Look in user profile screens, chat screens, and settings for block/mute options. Check if blocked users' content is excluded from feeds and responses. Look for a `blocked_users` or `muted_users` data structure in the database schema or state management. Search for `block` in API route handlers.
- **Pass criteria:** Users can block another user from their profile or from content. At least 1 implementation must be verified. Blocked users cannot send messages or their content is hidden from the blocking user's feeds.
- **Fail criteria:** No block or mute functionality despite having user interaction features (messaging, following, comments).
- **Skip (N/A) when:** App has no user-to-user interaction — no messaging, following, comments, or any surface where one user's content or actions affect another user's experience.
- **Detail on fail:** `"App has direct messaging but no way to block or mute other users"`
- **Remediation:** Apple guideline 1.2 requires apps with user interaction to offer the ability to block abusive users.
  1. Add a "Block" option on user profiles and in message/chat screens
  2. When a user blocks another:
     - Hide all their content from feeds
     - Prevent them from sending messages
     - Remove their comments from your posts
  3. Add a blocked users list in Settings so users can review and unblock
  4. Store block relationships server-side (not just locally) so they persist across devices

  Review the configuration in `src/` or `app/` directory for implementation patterns.

## External references

- external apple-guideline-1.2-ugc-block — https://developer.apple.com/app-store/review/guidelines/#user-generated-content

Taxons: regulatory-conformance, user-experience

HTML version: https://auditbuffet.com/patterns/ab-000500