Most people tap "Allow" on permission prompts without thinking about it. A few minutes understanding the model makes those prompts much more meaningful.
Runtime permissions vs. install-time permissions
Modern Android (6.0+) uses runtime permissions for anything sensitive — an app doesn't get access to your camera, location, or contacts just by being installed. It has to explicitly request each one, and you approve or deny at the moment it's needed, not as a blanket approval during install.
A smaller set of low-risk permissions (like internet access) are still install-time — granted automatically because they're considered low-risk by default.
The permissions worth actually scrutinizing
- Location — especially "Allow all the time" vs. "Allow only while using the app." Background location access is the single most common way apps track behavior beyond what the app itself needs to function.
- Microphone and Camera — legitimate for a camera app or video calling app; much harder to justify for a flashlight app or a game.
- Contacts — needed for messaging/social apps to find who you know; rarely needed for anything else.
- SMS — a permission worth being especially cautious about; it's involved in a lot of malware that intercepts one-time passcodes.
Checking what's granted, permission by permission
Settings → Privacy → Permission Manager (exact path varies slightly by Android version and manufacturer) lists permissions by category — tap "Location," for example, to see every app that currently has location access, rather than digging through each app individually.
This view is more useful than checking app-by-app, because it surfaces things you'd otherwise miss — like discovering three apps have background location access when you only remember granting it to one.
"Allow only this time" is underused
Since Android 11, location/camera/microphone prompts include a third option beyond Allow/Deny: "Only this time." This grants access for the current session only — the next time the app wants that permission, it asks again. For apps you use occasionally and don't fully trust with standing access, this is the better default over "While using the app."
Auto-revoke for unused apps
Android automatically revokes runtime permissions for apps you haven't opened in a few months. It's a genuinely useful default — an app you tried once for a single feature and forgot about doesn't need to retain standing access to your location or contacts indefinitely.
A practical five-minute audit
- Open Permission Manager, review the Location, Camera, Microphone, and Contacts categories specifically.
- For each app listed with "Allow all the time" on location, ask whether it genuinely needs background access — most don't.
- Revoke anything for an app you don't recognize or don't remember installing for that purpose.
This isn't about denying every permission reflexively — plenty of apps have legitimate reasons for what they ask. It's about the permissions matching what the app actually needs to do its job, not what it could theoretically use.
