Why apps ask for so many permissions, and which ones to refuse

A permission is a key, not a setting

I build apps for a living, and from the inside a permission looks very simple. The phone keeps certain things locked: your location, your contacts, the camera, the microphone. An app cannot touch them until you hand over the key.

That is all a permission prompt is. The app asks for a key. You decide.

The part people miss: the key does not come back on its own. Say yes once, and that app can use the thing behind it every time the rules allow, until you take the key back in settings.

Why apps ask for more than they need

Three reasons, in roughly the order I see them.

1. Convenience. Asking for everything at launch is easier to build than asking at the moment a feature needs it. Lazy, but common.
2. Future features. A team asks for contacts now because a sharing feature is planned for next quarter.
3. Advertising. Some apps, and especially the ad code inside them, are worth more with your location or contacts attached. This is the one to watch.

None of these is your problem. The app can ask again later, when it actually needs the key.

The three permissions I think about every time

Most permissions are low stakes. Three are not.

Permission	What it reveals	When an app genuinely needs it
Location	Where you live, work and go	Maps, ride apps, weather for your area
Contacts	Everyone you know, with their numbers	Messaging apps finding your friends
Microphone	What is said near your phone	Calls, voice notes, video

Camera and photos matter too, but they are easier to judge: an app either obviously needs them or obviously does not.

If I cannot name the feature that needs the key, I refuse. A torch app that wants my location gets a no, every time.

Use the narrowest answer the phone offers

Phones stopped making this a yes-or-no question years ago. Both Android and iPhone offer smaller keys, and I use them by default.

• While using the app. Location only when the app is open on screen. Right for almost every app.
• Only this time. The key works once and is gone when you close the app. Good for a one-off.
• Approximate location. The app knows your area, not your street. Enough for weather and local news.
• Selected photos. The app sees the photos you pick, not your whole library.

Start narrow. If a feature stops working, the app will say so, and you can widen the key then.

What it costs you to say no

Refusing is not free, and I would rather be straight about it. A map that cannot see your location cannot give turn-by-turn directions from where you are. A messaging app without contacts cannot tell you which friends are already on it; you add them by username instead.

The trade is usually small. You type a starting address once, or add three friends by hand. In exchange, one more company does not know where you sleep at night.

A five-minute review, a few times a year

Old permissions pile up. You granted location to a parking app in 2023 and forgot it exists. It has not forgotten you.

• On Android: Settings, Security & privacy or Privacy, then Permission manager. Pick a permission and see every app that has it.
• On iPhone: Settings, Privacy & Security. Each permission lists the apps with access.

Go through location, contacts and microphone first. Anything you do not recognise or no longer use, switch off. Recent Android versions also remove permissions from apps you have not opened in months, which helps, but I would not rely on it.

The rule I actually use

Say no by default. Say yes when a feature you want needs it, and pick the smallest key that makes the feature work.

That is it. You do not need to read every privacy policy or audit every app. You only need to stop handing out keys to doors nobody needs to open.