App permissions explained:
what your apps can really see

An app permission is a gate between an app and something sensitive on your device: hardware such as the camera or microphone, or data such as your location, contacts, photos and messages. Android and iOS block access to these by default; the app must declare what it wants and, for sensitive items, ask you¹⁵.

1. 2008–2015

   Install-time lists (Android)

   Apps showed all permissions before installing; the only choice was to accept everything or not install.

2. 2012

   iOS privacy controls

   iPhone apps must ask before reading contacts, photos and calendars.

3. 2015

   Runtime permissions (Android 6)

   Sensitive permissions are requested when needed and can be revoked².

4. 2019

   'Only while using the app'

   Android 10 adds foreground-only location; iOS had offered it since 2014.

5. 2020

   Approximate location and indicators

   iOS 14 adds approximate location, limited photo access and camera and mic dots; Android follows in 2021–22.

6. 2021

   App Tracking Transparency

   iOS 14.5 requires apps to ask before tracking you across other apps and websites⁶.

7. 2022

   Notification permission (Android 13)

   Apps must ask before sending notifications³; a photo picker lets you share chosen photos only⁴.

8. 2025–2027

   India's DPDP Rules

   Consent obligations under the Digital Personal Data Protection Act phase in from November 2025⁹¹⁰.

People who paid attention to permissions at install (2012 study)

17%

Who answered all comprehension questions correctly

3%

Android moves to runtime permissions

2015

Apple's App Tracking Transparency arrives

April 2021

The table lists common permissions, what they really allow and when it is reasonable to grant them.

Table: Common app permissions, what they allow and when to grant them (Android and Apple documentation; Science of Apps guidance)

Mostly not, and research has shown it for years. In a 2012 study at UC Berkeley, Adrienne Porter Felt and colleagues surveyed 308 Android users online and observed 25 in a lab. Only 17% paid attention to permissions during installation, and only 3% of survey respondents answered all three questions about what permissions meant correctly⁸. The researchers concluded that install-time warnings did not help most people make good decisions.

That finding is one reason both platforms moved to asking in context. A request that appears when you tap "Scan a document" ("Allow camera?") is easier to judge than a list of 15 permissions before you have used the app. It also reflects the default effect: when one option is easiest, most people take it, so the design of the prompt matters as much as the user's intentions.

1. Android: open the Privacy dashboard — Settings, then Security & privacy, then Privacy dashboard, shows which apps used location, camera and microphone in the last day.
2. Android: use the Permission manager — in the same menu, pick a permission to see every app that has it and change each one.
3. iPhone: open Privacy & Security — Settings, then Privacy & Security; tap Location Services, Camera, Photos or Contacts to review access⁵.
4. iPhone: read the App Privacy Report — it shows how often apps accessed sensitive data and which internet domains they contacted.
5. Switch off unused apps' access — Android can automatically remove permissions from apps you haven't used for months; leave that setting on.
6. Check the store listing — Google Play's Data safety section and the App Store's privacy labels describe what an app says it collects⁷.

For people building apps, permissions are a trust moment, and the way you ask changes the answer.

• Ask in context — request the camera when the user taps "scan", not on the first screen.
• Explain before the system prompt — a short screen saying why you need access, and what happens if they say no, raises informed acceptance.
• Ask for the least access — approximate location, the photo picker and "while using" are enough for most features.
• Work without it — if a user refuses, the app should still work, with that feature disabled and a way to enable it later.
• Never ask for SMS or accessibility unless it is your core feature — stores restrict them and users rightly distrust them.
• Prepare for India's DPDP Rules — consent must be free, specific, informed and as easy to withdraw as to give, with core obligations applying from May 2027¹⁰.

Pushing people into "Allow" with confusing wording or repeated prompts is a dark pattern, and it backfires once users notice. A clear, honest request is better for retention. Our onboarding audit reviews exactly these permission moments in new-user flows.

Runtime permission — a permission requested while the app is running, at the moment a feature needs it.

Foreground / background access — whether an app can use a permission only while it is open, or also when it isn't.

Approximate location — an area of a few square kilometres rather than your exact position.

Accessibility service — a powerful Android permission designed for assistive tools that can read the screen and perform actions.

App Tracking Transparency (ATT) — Apple's rule that apps must ask before tracking you across other companies' apps and websites.

DPDP Act — India's Digital Personal Data Protection Act, 2023, which sets consent rules for personal data; its Rules were notified in November 2025.

Permission behaviour and settings follow Android's and Apple's own developer and support documentation; the user-attention findings come from Felt and colleagues' SOUPS 2012 study at UC Berkeley; India's legal timeline from MeitY and law-firm analyses of the DPDP Rules notified in November 2025. Menu names differ slightly between phone makers and versions. The illustration is our own drawing of typical prompts, not a screenshot. Last reviewed October 2026.