Mobile App Permission Audit: A Step-by-Step Guide

A mobile app permission audit records what each app can access and whether that access still serves a feature you use.

Menu names vary by phone maker, operating-system release, device management, app source, and region. The Android paths below use standard Pixel-style labels; other Android devices may use slightly different names. Search Settings for the named screen if a path differs. On a work, school, health, or family-managed device, follow the owner's policy and support process.

Build the inventory first

Include these categories:

Those hold access that never appears in a store listing.

Do not copy full device identifiers, authentication secrets, private messages, or health data into the audit sheet. Record the app name and the permission, nothing more.

Use one row per app: App | device and versions | account and review date | permission or special access and current setting | feature that needs it | change and test result | exception, owner, and next review.

Review one app end to end

Then ask which feature you actually use needs each setting. "The app asked for it" is not a purpose. Mark anything you cannot justify as Unknown and test it later.

Review by permission category

On Android, open Settings > Security & privacy > Privacy > Permission manager. Choose a permission category, then an app, to review or change its access. For one app, use Settings > Apps > See all apps > [app] > Permissions. On iPhone, open Settings > Privacy & Security and choose a category, or open Settings > [app] to review that app's settings.

Google's instructions for changing Android app permissions cover the app-by-app and permission-type views, choices such as while in use or ask every time, and automatic pausing of unused apps on supported versions. Use that page for Android concepts and current steps, not for iOS or every manufacturer's menu.

Apple documents the iPhone side in controlling app access to information on iPhone, including the per-app permission list, the App Privacy Report showing how granted permissions were used, and where to revoke future access. To review the report, open Settings > Privacy & Security > App Privacy Report. Turn it on before relying on it to collect activity. The report lists Data & Sensor Access and network activity.

The category view earns its place by catching the app that looks harmless alone but sits among five microphone grants.

Tighten location

For each app with location access, record six things:

Move from always to while-in-use, from precise to approximate, or from permission to typing the place by hand. Test the feature afterward. A weather app set to approximate still finds your city; a delivery app may not find your door.

Limit contacts and media

Offer selected contacts or manual invitations instead of full address-book access where the app supports it. If a contact list was already uploaded, use the app's own controls to remove it and keep the confirmation.

Choose selected photos rather than the whole library. Before sending any image, check these details:

Check camera and microphone history

Privacy dashboards and recent-use indicators show when the camera or microphone was active. On Android, open Settings > Security & privacy > Privacy > Privacy dashboard, then choose Camera or Microphone to review access. When the green sensor indicator appears, tap it to identify the app. On iPhone, an orange dot indicates microphone use and a green dot indicates camera use; open Control Center to see which app recently used a sensor. The App Privacy Report is at Settings > Privacy & Security > App Privacy Report. Match each event to something you did. The dashboard covers a limited window, and access does not prove that anything was uploaded.

If an event makes no sense, revoke the permission, save the time and app details, update the app and the system, and ask the publisher or platform support. An indicator alone is not an accusation.

Separate the background controls

Background location, background data, app refresh, and unrestricted battery are different switches. Persistent notifications and foreground services are also different switches. Each has different effects. Review each one on its own.

On Android, check an app's background data at Settings > Apps > See all apps > [app] > Mobile data & Wi-Fi > Background data. To review unrestricted data, open Settings > Network & internet > Data Saver > Unrestricted data. On iPhone, open Settings > General > Background App Refresh, choose the overall refresh setting, and review the app switches. Settings > Cellular lets you turn cellular data off for an app; that is not the same as a background-data switch.

Turn off background access for an app that only needs data while it is open. Test navigation, calls, file sync, and health accessories carefully. Also test alarms and safety features carefully. Over-tightening breaks the service you wanted.

Inspect special access

Accessibility services and device administrators reach further than ordinary permissions. The same is true for notification access and display over other apps. So do install-unknown-apps and usage access. Several more roles also reach further:

On Android, check these screens individually: Settings > Accessibility > Installed apps for accessibility services; Settings > Security & privacy > More security & privacy > Device admin apps for device administrators; and Settings > Apps > Special app access for notification access, display over other apps, install unknown apps, and usage access. Check unrestricted data at Settings > Network & internet > Data Saver > Unrestricted data, VPNs at Settings > Network & internet > VPN, keyboards at Settings > System > Keyboard > On-screen keyboard, and the preferred password manager under Settings > Passwords, passkeys & accounts. Names and paths can differ by device.

Remove a role before uninstalling the app when the platform requires that order. If a sideloaded app asks you to bypass restricted settings, check the publisher and purpose somewhere independent first.

Compare what the app claims

Read the current store data label and the privacy notice. Record what they say about collection, sharing, advertising, retention, and deletion:

Then set that beside the permissions and dashboard events you found.

A network domain in a report shows a connection, not what data moved. A store label is the developer's own statement, not independent proof. Turn each mismatch into a precise question for the publisher.

Test, then close

Use the feature after tightening. Confirm that a denial gives you a clear choice instead of a dead end. Recheck permissions after the test and again after the next app update.

Before uninstalling, save local files and confirm you can still recover the account. Then remove connected access and close or delete the account separately if you want that. Log the change, the exception, the owner, and the next review date.

Common questions

Should every permission be denied by default?

Start narrow and grant access when a feature you chose needs it. Navigation, calling, safety, and accessibility functions may genuinely need continuing access, so judge those by use rather than by principle.

Does a permission dashboard show everything an app collected?

No. It covers supported device access during a limited period. It does not show account records the app already holds, network transfers, or anything from before the dashboard window.

Does uninstalling remove a VPN or device-management role?

Platforms differ. Remove special roles through system settings first, and follow managed-device policy before uninstalling. On a work or school device, the administrator controls that order.

When should the audit repeat?

After a major system or app update, a new phone, an unexpected indicator, a change of device owner, or a material change to what the app does.