Phone Permissions Audit: A Ten-Minute Step-by-Step Check
A practical permissions audit for Android and iPhone — camera, microphone, location, contacts and photos, plus accessibility and notification access.
Permissions are granted once and then forgotten for years. An app you installed for a single task in 2023 may still hold your camera, your location and your contact list. This is a six-part audit you can run in about ten minutes, in rough order of how much each one gives away.
Advertisement
| Before you start | Short answer |
|---|---|
| Where do I find all this? | Android: Settings → Privacy → Permission manager. iPhone: Settings → Privacy & Security. Both group apps by permission rather than the other way round. |
| Which permission matters most? | Accessibility service access, on Android. It is the most powerful thing you can grant and the least understood. |
| What if I revoke something I needed? | Nothing breaks permanently. The app asks again the next time it genuinely needs it. |
Advertisement
Step 1 — Camera and microphone
Start here, because this is the permission people assume is granted per use. It is not — it is granted to the app until you take it back.
- Open the camera list and read it as a whole. You are looking for anything you would not expect: a game, a torch, a wallpaper app, a file manager.
- Do the same for the microphone.
- Revoke anything you do not recognise or no longer use. Both systems offer an "ask every time" option, which is the right setting for an app you use rarely.
- Learn your phone’s live indicator. Android and iPhone both show a small dot or icon in the status bar when the camera or microphone is active. If it appears when you are not using either, find out which app is responsible.
Advertisement
Step 2 — Location, and the two choices inside it
Location is not one permission but a set of choices, and the useful settings are the ones people skip past.
| Setting | What to choose |
|---|---|
| When the app may use location | "While using the app" for almost everything. "Always" belongs to navigation and a small number of genuine background uses. |
| Precise or approximate | Weather, news and shopping apps work perfectly well on approximate location. Reserve precise for maps and ride-hailing. |
| Location history | A separate account-level setting on some services. Worth reviewing — it is usually far more detailed than people expect. |
| Per-photo location | Covered in Step 5, and worth turning off at the camera itself. |
Step 3 — Contacts, photos and messages
These three give away other people as much as they give away you, which is why they deserve a stricter standard than the rest.
- Contacts: an app granted this uploads names and numbers of people who never agreed to anything. Grant it only where sharing with contacts is the actual purpose of the app.
- Photos: both systems now let you share selected photos rather than the whole library. Use it. Most apps ask for everything and need one image.
- SMS and call logs: on Android, very few apps have a legitimate reason for these. Treat any request with suspicion, particularly from anything financial that is not your own bank’s app.
Step 4 — The two permissions that matter most on Android
These two sit outside the normal permission list, are rarely reviewed, and are far more powerful than anything above. If you check nothing else on this page, check these.
What it grants: the ability to read what is on screen and to act on your behalf — tap, type, navigate. It exists so that screen readers and similar tools can work, and it is the single most powerful permission on the device. Why it matters: because malicious apps request it precisely for that reach, often while claiming to be a cleaner, a battery saver or a support tool. What to do: open Settings → Accessibility and read the list of apps with access. If anything there is not a genuine accessibility tool you deliberately installed, turn it off.
What it grants: the ability to read the content of every notification your phone receives — including one-time codes, bank alerts and message previews. Why it matters: it quietly defeats the protection that codes are supposed to provide. What to do: find Notification access in Settings (usually under Apps or Special app access) and remove anything that is not a smartwatch companion or something equally obvious.
Step 5 — Where apps came from
An app installed from outside the official store has not been through any review, and this is the most common route for something genuinely harmful to arrive.
- On Android, check which apps may install other apps. It sits under Special app access → Install unknown apps. The correct answer for most people is none.
- Look through your full app list for anything you do not remember installing, particularly with generic names like "System Service" or "Update Manager".
- Be wary of an app sent as a file in a chat, however plausible the reason. This is the standard delivery route.
- On iPhone, check for configuration profiles under Settings → General → VPN & Device Management. Remove anything you did not knowingly add for work.
Step 6 — Make it a routine
A permissions audit works only if it happens more than once. Three habits keep it current without any effort.
- Put a ten-minute review in your calendar every three months. After the first pass it takes far less.
- Uninstall rather than revoke when you no longer use an app. An app that is gone cannot ask again.
- Answer permission prompts with "while using" or "ask every time" by default, and upgrade later only when something genuinely does not work.
Common questions
Rarely, and never permanently. An app that genuinely needs a permission asks again when it next needs it, and you can grant it in the moment with the context of knowing why.
Usually for advertising rather than function. A permission unrelated to what the app does is a reasonable reason to revoke it, and often a reasonable reason to find a different app.
It means the camera or microphone is currently in use by some app. It is normal during a call or while recording; it is worth investigating at any other time.
Both now offer per-permission control, selected-photo access and live indicators. Android exposes more settings, which means more to review; the practical difference comes down to whether the review is actually done.
Accessibility service access on Android. It grants the ability to read the screen and act for you, it is what malicious apps ask for, and almost nobody has ever looked at that list.
The six steps in one place
- Camera and microphone — revoke anything unexpected, set rare apps to ask every time.
- Location — "while using" and approximate, for almost everything.
- Contacts, photos and messages — share selected photos, and guard contacts hardest.
- Accessibility and notification access — the two most powerful, and the two least reviewed.
- Where apps came from — no app should be allowed to install other apps.
- Repeat quarterly, and uninstall rather than revoke.
