diff --git a/framework/src/android/net/ConnectivityManager.java b/framework/src/android/net/ConnectivityManager.java
index c820a7e80f..811b053332 100644
--- a/framework/src/android/net/ConnectivityManager.java
+++ b/framework/src/android/net/ConnectivityManager.java
@@ -5116,6 +5116,7 @@ public class ConnectivityManager {
      * @throws SecurityException if missing the appropriate permissions.
      * @throws UnsupportedOperationException if called on a non-automotive device.
      */
+    @RequiresPermission(android.Manifest.permission.CONTROL_OEM_PAID_NETWORK_PREFERENCE)
     private void setOemNetworkPreference(@NonNull final OemNetworkPreferences preference,
             @Nullable @CallbackExecutor final Executor executor,
             @Nullable final OnSetOemNetworkPreferenceListener listener) {
diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index 44ae458c78..c0d3e102af 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -2312,6 +2312,12 @@ public class ConnectivityService extends IConnectivityManager.Stub
                 NetworkStack.PERMISSION_MAINLINE_NETWORK_STACK);
     }
 
+    private void enforceOemNetworkPreferencesPermission() {
+        mContext.enforceCallingOrSelfPermission(
+                android.Manifest.permission.CONTROL_OEM_PAID_NETWORK_PREFERENCE,
+                "ConnectivityService");
+    }
+
     private boolean checkNetworkStackPermission() {
         return checkAnyPermissionOf(
                 android.Manifest.permission.NETWORK_STACK,
@@ -9334,8 +9340,9 @@ public class ConnectivityService extends IConnectivityManager.Stub
     public void setOemNetworkPreference(
             @NonNull final OemNetworkPreferences preference,
             @Nullable final IOnSetOemNetworkPreferenceListener listener) {
+
+        enforceOemNetworkPreferencesPermission();
         enforceAutomotiveDevice();
-        // TODO http://b/176496438 add permission check once permissions are added.
 
         Objects.requireNonNull(preference, "OemNetworkPreferences must be non-null");
         validateOemNetworkPreferences(preference);