Android App Permissions Explained: What Each One Really Grants

Permission prompts are approved in a second and never revisited. This is what each one grants, and which combinations deserve scrutiny.

Audit by permission, not by app

Settings › Security & privacy › Privacy controls › Permission manager.

Reviewing app-by-app means checking dozens of screens and never seeing the pattern. Reviewing by permission shows you every app holding Microphone in a single list, which is where surprises surface.

Do Location, Microphone, Camera, Files and media and Contacts first.

What each permission actually grants

Location

Three distinct levels, and the difference matters more than most people realise.

• Allow all the time — the app can request your position while it is closed. Justified for navigation, fitness tracking and find-my-device apps. Almost nothing else.
• Only while using the app — access only while it is in the foreground with a visible indicator. This should be your default answer.
• Ask every time — a one-off grant that expires when the app closes.

Separately, Precise location toggles between exact GPS coordinates and an approximate area of a few square kilometres. Weather, news, shopping and most social apps work perfectly on approximate location. Turn precision off for all of them.

Camera and Microphone

Full access to the sensor while the app is in the foreground. Background access requires a visible foreground service notification, and the green dot in the status bar appears whenever either is active.

The realistic risk is not a secret recording — it is an app you granted access to years ago that has since changed ownership.

Files and media / Photos and videos

Android now supports selected photos only: the app sees the specific items you pick and nothing else. Always choose this over full access for anything that just needs a profile picture or an attachment.

Full Files and media access lets the app read every document, download and image on the device. Reserve it for file managers and backup tools.

Nearby devices

Scans for and connects to nearby Bluetooth and Wi-Fi devices. Legitimate for headphones, wearables and smart-home apps. In anything else it is a proximity and presence signal — it can infer who you are near, and where you are, without Location permission.

Notifications

Since Android 13 apps must ask. Deny it freely; nothing else breaks. Note that an app with notification access can also read the content of notifications from other apps if you additionally grant Notification access under Settings › Notifications › Device & app notifications, which is a much more serious grant.

Contacts

Reads your entire address book, including names, numbers, emails and any notes. A single grant to one app can expose every contact you have — including people who never used the app. Deny by default; the system contact picker lets you share one contact without granting the permission. Our Android privacy checklist covers the wider settings worth changing.

Phone

Reads phone state, call logs and, on older API levels, hardware identifiers. Required for dialers and call-screening apps. Rare and suspicious elsewhere.

SMS

Reads and sends text messages. Almost never legitimate outside a default SMS app, and it is the classic route to intercepting one-time passcodes. Google restricts it heavily on the Play Store, so an app requesting it outside the store is a red flag.

The special access list — where real power lives

Settings › Apps › Special app access. These are not ordinary permissions and are far more consequential:

Audit Accessibility and Notification access specifically. A legitimate accessibility service is one you deliberately set up — a screen reader, a switch-access tool, a password manager's autofill. Anything else on that list should be removed today.

Revoking without breaking things

• Revoke and use the app normally. If something fails, it will prompt again with context — and you will finally know what it wanted the permission for.
• Enable Pause app activity if unused per app so long-unused apps lose their permissions automatically.
• After revoking, force stop the app so it re-reads its permission state.

Warning combinations

Individually reasonable, jointly a profile:

• Location (all the time) + Nearby devices — continuous movement and proximity tracking.
• Accessibility + Install unknown apps — the standard shape of Android banking malware.
• Notification access + SMS — full interception of one-time passcodes.
• Contacts + Files + Phone in a simple utility such as a torch or QR scanner — the app is a data collector with a feature attached.

A quick test before granting

Ask what the app's core feature is, and whether it can work without the permission. A QR scanner needs the camera. It does not need contacts, location or files — and you do not need one at all, since Android scans QR codes natively. When the answer is no, deny — and if the app then refuses to function, that is useful information about the app.

Machine-readable version: Markdown source