A wireless end-user device operates a network data traffic classifier and a policy enforcer in a kernel space and a service monitoring and reporting agent and a policy control agent in the user space. The user can accordingly view and set application network data traffic policies and view application network data usage, with the traffic classification/policy enforcement functions provided securely and efficiently within the kernel, through which the network data traffic flows to a modem.