Which app permissions should you turn off?
A dozen apps on your phone are probably still holding location, contacts or microphone access from years ago. Here is which permissions are worth turning off, which are safe to keep, and the ten-minute review that finds them on iPhone and Android.
The short answer
- Turn off location for anything that is not maps, ride-hailing or weather - set it to "while using" or "never", and switch off precise location almost everywhere.
- Be strictest with contacts. Granting it shares other people's names, numbers and sometimes addresses, which they never agreed to - very few apps genuinely need it.
- Revoke microphone and camera from any app with no voice or photo feature, and switch photo access to "selected photos" rather than full library.
- Permissions persist indefinitely once granted, including for apps you no longer use, so a review is worth repeating every six months.
- Do this by permission, not by app - iPhone (Settings > Privacy & Security) and Android (Settings > Privacy > Permission manager) both let you see every app holding one permission at a time.
Turn off location for every app except maps, ride-hailing and weather — "while using" instead of "always", approximate instead of precise. Revoke contacts from anything that is not a messaging app. Revoke microphone and camera from apps with no voice or photo feature, and switch photo access to "selected photos" rather than the full library. Do this by opening each permission category in Settings rather than going app by app — see "the review" below for the exact screens on iPhone and Android.
Permissions do not expire. The photo editor you installed for one holiday in 2022 still has your photo library. The parking app you used once still has your location. The game your child installed still has the microphone.
This is a ten-minute review, and it is the highest-value privacy action available to most people.
Why apps hold more than they need
Permissions are requested at install, when you are keen to use the app and refusing feels like it might break something. That is the moment of least resistance, and it is chosen deliberately.
Data has value independent of the app. Many free apps embed third-party code that reports location and identifiers to advertising and analytics companies. The app's function and the data flowing out of it are frequently unrelated — this is one of the routes into the profiles held by data brokers.
Nothing prompts a review. No system asks whether an app you have not opened in two years should still have your contacts.
The five that matter
Location — the most revealing
A movement history identifies your home, your workplace, your place of worship, your medical appointments and your relationships, without containing a single word of content.
Set almost everything to "while using" or "never". Turn off precise location for anything that is not navigation.
Full detail in location privacy.
Contacts — the one that affects other people
Very few apps need it. A messaging app finding friends is the legitimate case; almost everything else is building a social graph.
Microphone
Not because apps are secretly listening — the persistent rumour is largely unsupported, and both platforms now display an indicator whenever the microphone is active. It matters because it is a genuinely sensitive capability, and an app holding it without a reason should not.
If an app has no voice feature, it does not need the microphone.
Camera
Same reasoning. Grant it to apps that take photographs.
Photos
Both platforms now offer selected photos only rather than full library access. Use it. A photo library is a location history, a document archive, and a record of who you spend time with — full access is rarely warranted.
The review
Do this by permission rather than by app — it is much faster, and it shows you the pattern.
On iPhone: Settings → Privacy & Security. Go into each category — Location Services, Contacts, Microphone, Camera, Photos — and review the list of apps holding it.
On Android: Settings → Security & privacy → Privacy → Permission manager. Same idea, organised the same way.
For each app, three questions:
- Do I still use this? If not, delete the app — that revokes everything.
- Does its core function need this? A calculator does not need location.
- Can I downgrade rather than revoke? "While using" instead of "always", approximate instead of precise, selected photos instead of all.
The settings worth changing while you are there
iPhone
- Privacy & Security → Tracking → turn off "Allow Apps to Request to Track"
- Privacy & Security → Apple Advertising → turn off Personalised Ads
- Location Services → System Services → review, and turn off Significant Locations if you do not want a stored history of where you spend time
Android
- Privacy → Ads → Delete advertising ID
- Location → Location Services → review Google Location Accuracy and Location History
- Privacy → Permission manager → enable auto-revoke for unused apps
Then do it again
Set a reminder for six months' time. New apps accumulate, permissions get granted in a hurry, and a review that happens once is a review that decays.
Location deserves more than one line in a general audit, because it is not a single setting. How to stop apps tracking your location covers all four controls, including the advertising identifier and the background scanning most people never find.
Walk the audit with us
Our privacy walkthrough steps through both platforms, showing exactly what each permission exposes and what safely turns off.
Try it freeFrequently asked questions
- Which app permissions should I turn off?
- Start with location, contacts, microphone, camera and photo library. Set location to "while using" or "never" for everything except maps and ride-hailing, with precise location off almost everywhere. Revoke contacts from anything that is not a messaging app, and revoke microphone and camera from apps with no voice or photo feature.
- How do I check app permissions on my phone?
- On iPhone, open Settings then Privacy and Security, and go through each permission category to see which apps hold it. On Android, open Settings then Security and privacy then Privacy, and use the Permission manager. Both let you view by permission rather than by app, which is the faster way to audit.
- Which app permissions are the most sensitive?
- Location, contacts, microphone, camera and photo library. Location is the most revealing because a movement history exposes home, workplace and routine without any content. Contacts is the most ethically awkward, because granting it shares other people's details, which they never agreed to.
- What does "while using" location actually mean, and should I use it?
- The app can read your location only while it is open and in the foreground, rather than continuously in the background. For almost every app that legitimately needs location — maps, weather, ride-hailing — this is sufficient, and it removes the continuous movement history that always-on access creates.
- Why do apps ask for permissions they do not need?
- Because permissions are requested at install, when refusing feels like it might break the app, and because data has value independent of the app's function. Some apps embed third-party code that reports location or identifiers to advertising and data companies regardless of what the app itself does.
Sources
- New FTC Data Show People Have Lost Billions to Social Media Scams — Federal Trade Commission, 2026
- Turn Location Services and GPS on or off on your iPhone, iPad, or iPod touch — Apple, 2026
- Manage your Android device's location settings — Google, 2026
- Privacy and Mobile Device Apps — Cybersecurity and Infrastructure Security Agency (CISA), 2022
About the author
Cybersecurity & Digital Literacy
Subash Poudel builds SafeSurf IQ, a digital literacy platform that teaches people to recognise scams by putting them in front of real ones. He writes the online-safety reference material here, working from primary reporting — FBI IC3, the FTC, Verizon's DBIR, NCSC and Ofcom — rather than secondhand summaries.
- Founder and engineer, SafeSurf IQ
- Writes and reviews the platform's phishing, scam and privacy curriculum
- Works from primary incident and fraud reporting, cited on every article
Last reviewed . Figures are checked against the primary sources listed above at each review.
Read next
- Privacy
Online privacy: what is actually collected, and what you can change
Online privacy is not about having something to hide. It is about who holds a record of your behaviour, how precisely you can be identified without cookies, and which of those things you can practically change.
- Privacy
Is my phone secretly tracking my location?
A movement history contains no messages or photos, and it still reveals where you live, work, and who you spend nights with. Here is what is actually collecting your location - apps, ad code, photo metadata, Wi-Fi scanning - and how confident you can be that it is really private.
- Privacy
How to remove your personal information from data brokers
Your name, address, relatives and estimated income are already for sale on people-search sites you have never heard of. Here is how to find what is exposed, remove it from the brokers that matter most, and reduce how quickly it comes back.