How to Review App Permissions on Your Phone Without Breaking Anything

Most phones carry somewhere between 60 and 120 installed apps, and each one asked for something when you first opened it. Location, camera, contacts, microphone, notifications. You tapped "Allow" because you wanted to get on with your day, and that was a reasonable choice at the time. The trouble is that those answers never expire on their own unless the phone does it for you, and the app you used once for a parking meter in 2023 may still be allowed to see where you are.

A permission review is not a dramatic security project. It takes about 20 minutes the first time and five minutes every few months after that. Done carefully, it cuts the amount of personal data leaving your phone without breaking the apps you rely on. Here is how we approach it on both Android and iPhone, and which permissions deserve the most attention.

Why Permissions Drift Over Time

Apps change after you install them. A flashlight app gets bought by an advertising company. A shopping app adds a "stores near you" feature and starts asking for location in the background. A game you stopped playing still holds access to your photos because you once shared a screenshot from inside it.

None of this is necessarily malicious. It is just accumulation. The phone keeps a record of every "yes" you gave, and very few people ever go back to look at that record. The result is a phone where a dozen apps can reach data they have no current reason to touch.

Where to Find the Permission Screens

Both major systems now offer two views: a list of permissions showing which apps use each one, and a per-app view showing everything a single app can do. The first view is the faster way to review.

On Android

Open Settings, then Security and privacy (the exact name varies by manufacturer), then Privacy, then Permission manager. You will see categories such as Location, Camera, Microphone, Contacts and Files. Tap one and the apps are split into "Allowed all the time", "Allowed only while in use" and "Not allowed". Android 12 and later also include a Privacy dashboard that shows which apps used location, camera or microphone in the last 24 hours, which is useful for spotting surprises.

On iPhone

Open Settings, then Privacy and Security. Each category, such as Location Services, Photos, Contacts and Microphone, lists the apps that asked for it. The App Privacy Report, turned on from the bottom of the same screen, records which apps accessed sensitive data and which network domains they contacted over the past seven days.

The Five Permissions Worth Checking First

You do not need to audit every toggle. These five carry the most risk and the most value to advertisers.

Location, especially "all the time". Very few apps need background location. Navigation, a find-my-device service and perhaps a weather widget are the usual exceptions. Everything else should be "while using" or "never".
Precise location. Both systems let you share an approximate area instead of your exact spot. A weather or news app works fine with approximate location accurate to a few kilometres.
Microphone. Messaging, calling and voice-note apps need it. A recipe app or a shopping app usually does not.
Contacts. Granting this hands over the names and numbers of people who never agreed to anything. Social apps often ask for it to "find friends", which you can skip.
Photos and files. Choose "selected photos" or "limited access" where offered, so an app sees only the pictures you pick rather than your whole library.

How to Change Settings Without Breaking Apps

The worry most people have is that turning something off will make an app stop working. In practice, modern apps are built to ask again when they need a permission, so the risk is small. Still, a little method helps.

Downgrade before you remove. Move location from "always" to "while using" first. If the app still does what you need for a week, you can consider going further.
Leave essential system apps alone. Phone, Messages, Camera and the built-in maps app need their core permissions. Changing them can cause confusing failures.
Test the one feature you care about. After changing a banking app's camera access, for example, try depositing a cheque photo. If it fails, the app will normally prompt you, and you can allow it again in one tap.
Delete instead of restricting. If you have not opened an app in three months, removing it is cleaner than trimming its permissions.

One more safeguard: Android automatically resets permissions for apps you have not used in a few months, and iPhone asks you periodically whether an app should keep background location. Leave both features switched on.

A Quick Reference Table

App type	Reasonable permissions	Usually unnecessary
Navigation	Precise location, background location while navigating	Contacts, microphone (unless using voice search)
Weather	Approximate location while in use	Precise or background location
Messaging	Contacts, camera, microphone, notifications	Background location
Shopping	Camera for barcode scanning, notifications if wanted	Contacts, microphone, background location
Games	Notifications if wanted	Location, contacts, microphone (unless voice chat)
Banking	Camera for cheque deposits, biometrics	Contacts, background location

Signs an App Deserves a Closer Look

Some patterns suggest an app is collecting more than it needs. A simple utility, like a calculator or QR scanner, asking for contacts or location is a clear warning. So is an app that refuses to open at all until you grant a sensitive permission unrelated to its main job. Watch for the green or orange dot at the top of the screen too: it means the camera or microphone is active right now. If it appears while you are scrolling a news app, check which app is responsible.

If an app behaves this way and you did not install it from the official store, remove it. Sideloaded apps and those arriving through links in messages are a common route for spyware. Our guide on spotting a phishing link before you click covers how those links usually look.

Making It a Habit

The first review is the long one. After that, a quarterly check is enough for most people. Pair it with something you already do regularly, like installing a major system update. Spend five minutes in the location and microphone lists, glance at the privacy dashboard or report, and delete anything you have stopped using. Permissions are one layer; turning on two-factor authentication for your main accounts is another, and together they close off most of the easy ways in.

Frequently Asked Questions

Will removing a permission delete my data in that app?

No. Revoking camera or location access only stops future use. Your saved files, chat history and account details stay where they are. The app may simply ask for the permission again the next time it needs it.

Do I need a security app to manage permissions?

No. The built-in settings on current Android and iPhone versions show everything a third-party tool would, and they cannot be uninstalled or sold to another company. Adding another app with broad access to review permissions somewhat defeats the purpose.

Why does an app keep asking after I said no?

Some apps request again when you open the feature that uses the permission. If it happens every time you launch the app, choose "Don't ask again" on Android, or leave the setting off on iPhone, where repeated prompts are restricted by the system.

The Short Version

Open the permission list by category, start with location, microphone and contacts, downgrade rather than switch off when unsure, and delete apps you no longer use. Twenty minutes now and five minutes a season keeps your phone sharing only what you meant it to share. More practical guides sit in our security section.