Fifteen Permissions That Deserve a Second Look: Your Android and iOS Audit List
Photo: booledozer, CC0, via Wikimedia Commons
Most Americans grant app permissions the way they accept cookie banners: quickly, reflexively, and without much thought. Yet a handful of permissions stand apart for how much they expose when abused. Below is a ranked audit list — fifteen permissions and access levels that warrant a look on every device in your household, with revocation steps for both platforms.
The Top Tier: Treat With Genuine Caution
1. Accessibility Services (Android). Originally designed to help users with disabilities, accessibility access lets an app read screen contents, observe your taps, and even interact with other apps. It is the single most powerful permission on Android, and it has been abused to read banking screens and intercept credentials. Revoke: Settings → Accessibility → Installed apps (varies by manufacturer) → disable anything that does not plausibly need it.
2. Notification Listener Access (Android). An app with this access reads every notification — including one-time passcodes from your bank, which arrive as notifications before you ever see them. Revoke: Settings → Notifications → Device & app notifications → toggle off unfamiliar apps.
3. Device Administrator / Device Manager (Android). Grants an app the ability to prevent uninstallation and, in malicious cases, lock the device for ransom. Revoke: Settings → Security → Device admin apps.
4. Full Disk Access / Screen Recording (macOS-adjacent and iOS Screen Mirroring). On iOS, be wary of any app requesting screen-recording via Screen Share in support chats — a known vector for remote scam assistance. Revoke: Settings → Privacy & Security → Screen Recording.
5. Install Unknown Apps (Android). Not a classic permission but an entitlement that lets an app sideload others — the delivery mechanism for most Android malware families. Revoke: Settings → Apps → Special app access → Install unknown apps.
The Middle Tier: High Value to Attackers
6. Contacts. Exposes names, numbers, and emails of everyone you know — fuel for phishing and smishing campaigns targeting your network. Revoke: iOS: Settings → Privacy & Security → Contacts; Android: Settings → Apps → [App] → Permissions.
7. Precise Location. Continuous precise location reveals your home, workplace, and routines. Allow only while-in-use, and only for apps that truly need it — maps, weather, ride-share. Revoke: iOS: Settings → Privacy & Security → Location Services; Android: Settings → Location → App location permissions.
8. Microphone. A 2023-class of attacks demonstrated apps inferring user activity from ambient audio. Grant per-use, never "always allow," except for dedicated voice-assistant use you actually want. Revoke via the same Privacy menus.
9. Camera. Beyond photos, camera access enables QR-code interception and facial-data harvesting by unscrupulous SDKs. Revoke for any app without a camera function.
10. Photos / Media Access. Full photo library access exposes location metadata embedded in images and, on iOS 17+, can extend to shared albums. Prefer limited selection when iOS prompts you.
11. SMS and Call Log (Android). Reading SMS means reading your two-factor codes directly at the source. Google Play restricts this permission, but sideloaded and older apps may still request it. Revoke: Settings → Apps → [App] → Permissions → SMS.
The Lower Tier: Quietly Noisy
12. Nearby Devices / Bluetooth. Bluetooth scanning builds a physical-movement profile. Revoke for apps that never pair hardware: iOS: Settings → Privacy & Security → Bluetooth.
13. Local Network Access (iOS). Reveals devices on your home Wi-Fi — a reconnaissance tool in the wrong hands. Revoke: Settings → Privacy & Security → Local Network.
14. Motion & Fitness. Accelerometer data can infer typing, gait, and location. Rarely necessary; revoke freely.
15. Default SMS/Phone App Override (Android). An app asking to become your default dialer or messaging app gains standing access to everything those apps see. Ask why before agreeing.
Making the Audit a Habit
Both platforms now help you: iOS periodically re-prompts for unused permissions, and Android automatically removes them from dormant apps. But automation is a floor, not a ceiling. Set a calendar reminder — quarterly works for most households — to walk through the Privacy & Security menus on every family device, especially the ones your children and parents use.
Permissions are the vocabulary through which apps speak about you. Make sure the conversation stays one you agreed to.
