Apps often need some access to work, but a permission request should make sense for the task. A map app may need location while navigation is active; a simple calculator usually has no clear reason to access your microphone or contacts. Reviewing permissions is a straightforward privacy habit.
Quick overview: permissions worth checking first
Start with location, camera, microphone, photos and contacts. Restrict access to what each app needs, and pay special attention to background location and powerful special access. The sections below explain the specific settings and trade-offs.
How to review permissions
Open Settings and search for Permission manager or Privacy; menu names vary by phone maker and Android version. For device-specific steps, consult the official Android Help Centre.
Watch for unusual requests
Treat Accessibility, unknown-app installation, notification access and display-over-other-apps as powerful controls. Grant them only when the app’s purpose clearly needs them, not because a pop-up promises a prize or claims your phone is broken.
Check apps you no longer use
Remove apps you no longer need, verify the publisher before installing something new, and avoid APK files sent through unsolicited messages.
What permissions cannot tell you
Permissions are only one privacy layer; account settings, information you enter and an app’s data policy also matter.
Quick privacy check
Start with background location, camera and microphone access, then remove unused apps and keep your phone updated. A fuller step-by-step audit appears below.
Bottom line
Use the detailed audit and final checklist below to review permissions carefully, then revisit them when installing apps or after major updates.
Related reading
For broader mobile privacy advice, see our smartphone data privacy guide and learn how to free up Android storage safely.
Why the minimum-permission approach works
Permissions control access to sensitive parts of a phone, but they are not a simple score for whether an app is safe. A legitimate app may need a permission for a feature you choose to use, while a poorly designed or malicious app may request more access than its core purpose requires. The useful question is: “Does this permission make sense for the feature I want, right now?”
Android versions and manufacturer interfaces differ, so exact menu names can vary across Samsung, Pixel, Xiaomi, OnePlus and other phones. Use the Settings search box for “Permission manager”, “Privacy” or the name of a permission if the menu described in a guide does not match your device. Avoid installing a separate “permission cleaner” app just to perform a check that Android already provides.
Location: choose the narrowest useful access
Navigation apps may need location while you are using them. A weather app may work with a manually selected city, and a shopping app usually does not need constant background location for basic browsing. Where offered, consider approximate location or “while using the app” access rather than precise, always-on access. If a feature genuinely requires background tracking, check why and whether you want it enabled.
Remember that location can sometimes be inferred from other information, such as check-ins, photos or network data. Changing a permission reduces one type of access; it does not make every activity anonymous. Review location sharing inside the app itself as well as Android’s system permission.
Camera and microphone: allow access when needed
Video calling, scanning documents and taking photos are clear reasons for camera or microphone access. If an app asks for these permissions even though its features do not appear to need them, deny access and see whether the app still works. You can often grant permission temporarily or enable it only while using the app.
Modern Android versions may show indicators when the camera or microphone is active and provide system-level privacy controls. If you notice unexpected access, close the app, review its permission history if your device offers it and investigate before continuing. A permission indicator is a useful clue, not a substitute for keeping the operating system updated.
Photos, files, contacts and notifications
When available, selected-photo access lets you share particular images without giving an app broad access to your entire library. File-management apps may need file access for their core purpose, but a simple game or flashlight utility generally has little reason to read personal documents. Contacts access can expose names, phone numbers and relationships, so consider whether the app really needs your address book.
Notifications are less sensitive than some permissions but can still reveal private messages on a lock screen or encourage unwanted engagement. Disable alerts that are not useful and configure lock-screen previews to match your privacy needs. Check the app’s own settings too, because notification categories and privacy options vary.
Be careful with powerful special access
Some controls are not ordinary permissions. Accessibility access can let a service observe or interact with screen content to support users with disabilities, but it can also be abused. Notification access may expose message previews and one-time codes. “Display over other apps” can place windows above other applications, while permission to install unknown apps allows a source to install packages. Device administrator or VPN access can also have broad effects.
These features have legitimate uses, so do not automatically assume every request is malicious. Instead, verify the app publisher, understand the feature, and deny access when the explanation is vague or unrelated. Be especially suspicious of messages claiming that you must enable Accessibility or install an APK to receive a refund, claim a prize or fix an account.
Step-by-step Android permission audit
- Open Settings and search for Permission manager or Privacy.
- Review location, camera and microphone access first.
- Check contacts, photos, files, SMS and call-related permissions where shown.
- Review special app access such as Accessibility, notification access and installing unknown apps.
- For each app, ask whether the permission matches a feature you use.
- Change unnecessary access to “Don’t allow” or a narrower option, then test the feature.
- Uninstall apps you do not recognise or no longer need.
- Install Android and app updates from official sources and keep a secure screen lock enabled.
What to do if an app stops working after you revoke access
Some features will stop until you grant the permission again. Open the app’s settings and identify the specific feature you need, then allow only the relevant access if you trust the publisher. For example, a QR scanner may need camera access when scanning, but it should not need your contacts simply to read a code. If the app refuses to work unless you grant unrelated access, consider using a reputable alternative.
Permissions are only one part of privacy
An app can collect information you type into it, associate activity with your account, or share data according to its privacy policy. Permissions do not explain every data practice. Review the app’s data safety information and privacy policy, particularly for banking, health, messaging, storage and workplace apps. Download apps through trusted official stores, check the developer name and be wary of clones with similar icons.
Keep Play Protect enabled where available, install security updates, use a strong device lock and never share an OTP or password with someone who contacts you unexpectedly. If you suspect an account has been compromised, change the password from a trusted device and review active sessions through the service’s official website or app.
Frequently asked questions
Can I deny every permission?
You can deny many permissions, but features that depend on them may not work. Grant access only when you use a feature that needs it and understand the request.
How often should I review permissions?
Check after installing unfamiliar apps, after major system changes and periodically as part of a short privacy review. You do not need to change settings every day.
Does denying location make me completely private?
No. It limits direct location access through that permission, but apps may still receive information you provide or infer location from other signals. Review account settings and data policies as well.
Should I install an APK sent over WhatsApp?
Avoid installing unsolicited APK files. They may impersonate legitimate apps or request powerful access. Find the app through its official developer or a trusted app store instead.
Five-minute privacy checklist
Start with the apps that hold the most sensitive information. Limit background location, review camera and microphone access, remove unnecessary contact and photo access, inspect special permissions and uninstall unused apps. Repeat the check whenever an unfamiliar prompt appears. A small, regular review is easier to maintain than trying to fix privacy problems after an account has been compromised.