A wireless end-user device has wireless wide-area network (WWAN) and wireless local-area network (WLAN) modems. One or more processors classify whether an application is interacting with a user in a user interface foreground of the device. At a time when Internet service activities are communicated through a first wireless network type, the processors use a differential traffic control policy list to determine whether or not to apply a differential traffic control policy to an application requesting Internet service access. When the policy is applicable, and the application is not classified as interacting with a user in the device user interface foreground, the Internet service access request is blocked. A network element supplies or contributes to the contents of the traffic control policy list via secure updates transmitted to the processor(s).