Android permissions, explained properly

Most people learn about permissions the same way: a dialog appears, it's in the way of something you wanted to do, and you tap Allow. The prompt tells you an app wants your location. It doesn't tell you how often, whether that continues when the app is closed, or who else ends up with the answer.

Here's what the common ones actually mean, and which ones are worth stopping for.

Two different kinds of permission

The dialogs you see are runtime permissions. Camera, microphone, location, contacts, calendar, nearby devices, body sensors. The app asks, you allow or deny, and you can change your mind later in Settings. Android makes an app ask at the moment it needs the thing, which is why the request usually arrives attached to an obvious action.

The ones that matter more don't appear as a dialog at all. Special access permissions live in their own corner of Settings, and granting one takes several deliberate taps because of how much it hands over:

• Notification access lets an app read every notification your phone receives, from every app, including message previews and one-time codes.
• Accessibility service was built so screen readers could work. It can read the content of your screen and act on your behalf. It is the single most powerful thing you can grant an app.
• All files access gives an app your whole shared storage rather than the specific files you picked.
• Display over other apps lets an app draw on top of whatever you're using.
• Usage access reveals which apps you open and for how long.

If an app asks for one of these, the question isn't whether you trust the company. It's whether the feature you're getting is worth that much reach. A note-taking app that wants accessibility access is not a note-taking app.

What the everyday ones really give away

Location. Android splits this into approximate and precise, and separately into "while using the app" and "all the time". Approximate is accurate to a few hundred metres and is plenty for weather, or for a compass working out magnetic declination. Precise is metre-level. Background location is the one to guard: it means the app can ask where you are when you aren't using it, which is the raw material of a movement profile. Android surfaces this as a separate, harder-to-grant step for good reason.

Camera and microphone. Granted, an app can use them while it's in the foreground. Recent Android versions put a green dot in the status bar whenever either is active, which is worth watching for. If the dot appears when you aren't doing anything camera-shaped, something is using it.

Photos and media. You often don't need to grant this at all any more. The system photo picker lets you hand over specific images without giving the app access to your gallery. If an app insists on full media access to let you set one profile picture, that's a choice its developers made, not a platform limitation.

Contacts. The most quietly expensive one. You're not just sharing your own details, you're sharing other people's, and they never got asked. An app that wants contacts to "help you find friends" is usually uploading the address book.

Notifications. On recent versions apps have to ask before they can notify you at all. Denying it doesn't break the app.

The permission list on the Play Store

Before you install anything, the store listing shows what the app can request. It's near the bottom of the page, under "App permissions" or "Data safety", depending where you look.

Read it against what the app claims to do. A torch app needs the flashlight and nothing else. A QR scanner needs the camera. When the list runs to fifteen items on a single-purpose tool, the extra ones exist for someone else's benefit.

The Data Safety section next to it is worth a glance too, though remember it's self-declared. It's what the developer says they collect, not an audit.

Taking permissions back

Nothing you grant is permanent.

Go to Settings → Apps, pick an app, and open Permissions. Everything it holds is listed there, and every one can be revoked. Some apps will complain or lose a feature. Most simply carry on.

There's also a view organised the other way round, usually at Settings → Security & privacy → Privacy → Permission manager, which shows every app holding a given permission. Opening the Location entry there is a genuinely useful five minutes. People are routinely surprised by what's on the list.

Two things Android does on your behalf, which are worth knowing about:

• Unused app auto-reset. Apps you haven't opened in a few months have their permissions revoked automatically. If an old app suddenly asks again, that's why.
• One-time permissions. When a prompt offers "Only this time", the grant expires when you leave the app. It's the right answer more often than people use it.

A short way to decide

When a prompt appears, one question does most of the work: does the thing I just tapped need this to happen?

Tapping the camera button in a scanner needs the camera. Opening a wallpaper app doesn't need your contacts. The gap between the action and the request is the signal. When a permission arrives at app launch, unattached to anything you asked for, deny it and see whether you ever miss it.

And when you can't work out why an app wants something, that's an answer in itself. A well-built app explains the request before the dialog appears, because its developers know the request looks strange without context. Silence usually means the reason wouldn't help their case.