How Android App Permissions Actually Work

Permissions are the most important privacy control on your phone, and also the most misunderstood. Here’s how they actually work — not the marketing version, the real mechanics — so you can make informed choices.

A permission is a gate the system enforces

Every sensitive capability on Android — reading your location, using the camera, accessing contacts, sending SMS — sits behind a gate controlled by the operating system, not the app. An app can request to pass through, but only Android decides whether it can, based on what you’ve granted. This matters: an app can’t simply help itself to your microphone because its code wants to. If the permission isn’t granted, the request fails at the system level.

Two kinds of permission

Normal permissions cover low-risk things (vibrate, connect to the internet, set an alarm). Android grants these automatically at install because they can’t expose personal data or cost you money. Sensitive (runtime) permissions cover the things that can — location, camera, microphone, contacts, SMS, call logs, body sensors, files. These require your explicit approval.

Why prompts appear when they do

Older Android asked for every permission up front, at install, as one long list nobody read. Modern Android asks in context: the first time a messaging app needs your camera, it prompts you right then, so the request makes sense. You can allow, deny, or — for the sensitive trio of location, camera and mic — grant one-time or “only while using the app” access.

Foreground vs background access

The biggest privacy leap was separating “while using the app” from “all the time.” Background location, in particular, is how apps quietly track you when closed. Android now makes background access a separate, deliberate choice, and shows an indicator when the camera or mic is active. If an app only needs your location while you’re using it, that’s all it should get.

Auto-revoke and transparency

Two more modern touches: Android automatically revokes permissions from apps you haven’t opened in a while (so a forgotten app doesn’t keep access forever), and the Privacy Dashboard shows which apps used which permissions and when. Both help you notice an app reaching for more than it should.

Putting it to use

Because the system — not the app — enforces permissions, you are genuinely in control: denying or revoking a permission works. Grant only what an app plausibly needs, prefer “while using the app,” and review the Privacy Dashboard occasionally. For the practical how-to, see how to check what permissions an app really needs. And remember that sideloaded apps skip the store’s scanning entirely — one more reason to avoid unofficial APKs.