How to specify to not allow any data backup with android:dataExtractionRules?

Add dataExtractionRules attribute to your AndroidManifest.xml file with a reference to data_extraction_rules.xml file:

<application
    android:allowBackup="false"
    android:fullBackupContent="false"
    android:dataExtractionRules="@xml/data_extraction_rules"
    ...>

Then, exclude all possible domains for cloud backups and d2d transfers, update or create a file app/src/main/res/xml/data_extraction_rules.xml:

<?xml version="1.0" encoding="utf-8"?>
<data-extraction-rules>
    <cloud-backup>
        <exclude domain="root" />
        <exclude domain="file" />
        <exclude domain="database" />
        <exclude domain="sharedpref" />
        <exclude domain="external" />
    </cloud-backup>
    <device-transfer>
        <exclude domain="root" />
        <exclude domain="file" />
        <exclude domain="database" />
        <exclude domain="sharedpref" />
        <exclude domain="external" />
    </device-transfer>
</data-extraction-rules>

The dataExtractionRules attribute is available for API 31 (Android 12) and higher. Keep allowBackup and fullBackupContent attributes for Android versions before API 31.

Note to maybe silence “Attribute dataExtractionRules is only used in API level 31 and higher (current min is 19)” warning, with tools:targetApi="s" attribute as well (because older platforms simply ignore manifest-attributes they don’t support, and the warning is useless).