How to Check App Permissions on Android and iPhone

The average phone has somewhere between 40 and 80 apps installed, and many of them asked for access to your location, contacts or microphone the day you installed them. You tapped Allow to get past the prompt and never thought about it again. Learning to check app permissions takes about 15 minutes, and it is one of the few privacy tasks that has a clear, visible payoff.

This guide walks through where the settings live on Android and iPhone, which permissions deserve a hard look, and how to keep things tidy without turning it into a weekly chore.

Why it is worth the time to check app permissions

Permissions are the gates between an app and the sensitive parts of your phone. A flashlight app with access to your contacts is not necessarily malicious, but it has no reason for that access, and every unnecessary permission is one more route for data to leak if the app is sold, abandoned or compromised.

The bigger issue is drift. Apps you installed years ago for one trip or one event often keep background location or camera access long after you stopped using them. Some ad and analytics code inside free apps collects location data and passes it on to data brokers. You cannot audit that code, but you can cut off what it is allowed to see.

How to check app permissions on Android

Menu names vary slightly between Samsung, Google Pixel, Motorola and other brands, but the layout is similar on Android 12 and later.

Open Settings and go to Security and privacy, then Privacy.
Tap Permission manager. On some Samsung phones this is under Settings, Security and privacy, then Permissions.
You now see a list grouped by permission type: Location, Camera, Microphone, Contacts, Files, Phone and more.
Tap a category to see which apps are allowed "all the time", "only while in use", or "ask every time".
Tap any app to change its setting.

Android also has a Privacy dashboard on most recent versions, under the same Privacy menu. It shows which apps used location, camera or microphone in the last 24 hours, and on newer versions the last 7 days. This is the fastest way to spot an app doing something it should not.

Turn on automatic permission removal

Since Android 11, the system can automatically remove permissions from apps you have not opened for a few months. Go to Settings, Apps, choose an app, and check that Pause app activity if unused or Remove permissions if app is unused is switched on. It is on by default for most apps, but worth confirming for older ones.

How to check app permissions on iPhone

Apple groups everything in one place.

Open Settings and tap Privacy and Security.
You see categories such as Location Services, Contacts, Photos, Microphone, Camera, Bluetooth and Local Network.
Tap a category to see every app that requested it and what level of access it has.
For Location Services, each app can be set to Never, Ask Next Time, While Using the App, or Always. You can also switch off Precise Location so the app only gets an approximate area.

Scroll to the bottom of the Privacy and Security page to find App Privacy Report. Once turned on, it records which apps accessed your data and which network domains they contacted over the last seven days. Leave it running for a week and then read it; the results are often surprising.

The permissions that matter most

Not every permission carries the same risk. Spend your 15 minutes on these, roughly in this order.

Permission	Why it matters	Sensible default
Location, always	Builds a detailed record of where you live, work and travel	Only for maps, family sharing or a fitness tracker you rely on
Microphone	Can capture audio while the app is open	Calls, voice notes and video apps only
Camera	Photos and video, plus metadata	While in use, for apps you actually take pictures with
Contacts	Uploads other people's details, not just yours	Messaging apps only, and only if you want friend matching
Photos and files	Access to years of images, documents and screenshots	Selected photos only, where the option exists
Accessibility (Android)	Can read the screen and act on your behalf	Only for genuine assistive tools and password managers

Accessibility access on Android deserves a special mention. It is the permission most abused by banking trojans, because it lets an app see and tap anything on screen. Check it under Settings, Accessibility, Installed apps. If you see something you do not recognise, remove it first and investigate afterwards.

Why denying everything is not the answer

A lot of privacy advice says to deny every permission by default and only grant what breaks. It sounds safe, but in practice it causes problems that push people back to blanket Allow.

Deny location to your weather app and it shows the wrong city. Deny notifications to your bank app and you miss fraud alerts. Deny camera to a messaging app and you cannot scan a QR code to log in. After a week of frustration, most people give up and tap Allow on everything again, which is worse than where they started.

The better rule is "while in use" by default and "always" almost never. Very few apps genuinely need background location or microphone access. Most need permissions only while you have them open, and both Android and iPhone now let you grant exactly that. Pair this with "ask every time" for apps you use occasionally, and you get most of the privacy benefit without breaking anything.

A simple routine to keep permissions tidy

Once now: do a full pass through the table above. Expect it to take 15 to 20 minutes.
Every three months: open the privacy dashboard or App Privacy Report and look for anything unexpected. Delete apps you have not opened since the last check.
Before travel or public Wi-Fi: combine a permission check with the steps in securing your phone before you use public Wi-Fi.
When setting up a phone for a child: set permissions before handing it over. Our guide to parental controls on a child's first phone covers the rest.

The same thinking applies on your computer. Browser add-ons ask for broad permissions too, and the checklist for which browser extensions are safe to keep follows the same logic.

Frequently asked questions

Which app permissions should I never allow?

There is no permission that is always wrong, but be very cautious with Accessibility access on Android, "always" location, and microphone access for apps that do not involve calls or audio. If an app's purpose does not obviously need a permission, deny it and see if anything breaks.

Do apps listen through your microphone?

Modern Android and iPhone both show an indicator, a green or orange dot or icon, whenever the microphone or camera is in use. There is no strong evidence that mainstream apps secretly record conversations for ads, but restricting microphone access removes the possibility. Check the privacy dashboard if the indicator appears when you did not expect it.

Does removing permissions break apps?

Sometimes a feature stops working, but the app itself usually keeps running and will ask again when it needs access. That prompt is useful, because it tells you exactly which feature depends on the permission. You can then decide whether the feature is worth it.