Every app you install asks for something: access to the camera, contacts, location, notifications. The requests often arrive all at once on first launch, when you are in a hurry to use the app, and the answer is an "Allow" given without thought. Yet permissions are where you actually decide which parts of your digital life an app will be able to see.
Why permissions matter
Article 5 of the GDPR sets out the principle of data minimisation: data collected must be adequate, relevant and limited to what is necessary for the purposes. Article 25 also requires data protection by design and by default. An app that asks for access to your address book in order to show you the weather forecast is hard to reconcile with these principles.
Mobile operating systems give you a practical tool to enforce minimisation even when the developer does not: denying or limiting unnecessary permissions.
The relevance test
For each request, ask yourself whether the permission is linked to the feature you are using.
| App | Relevant permission | Suspicious permission |
|---|---|---|
| Torch | Access to the flash | Location, contacts, microphone |
| Video calls | Camera and microphone | Call log, text messages |
| Navigation | Location while in use | Contacts, photos |
| Photo editor | Access to selected photos | Microphone, background location |
| Offline game | None, or almost none | Contacts, location, phone |
A suspicious permission does not necessarily mean unlawful behaviour, but it is a signal to read the app's privacy notice carefully or look for an alternative.
The most sensitive permissions
Location
This is one of the most revealing kinds of data: from a sequence of places one can infer home, work, habits and acquaintances. Recent operating systems distinguish between:
- location only while using the app, enough for almost every feature;
- location always, including in the background, justified only by specific features such as tracking a workout in progress;
- approximate location, which is enough for weather and local news.
Microphone and camera
Grant them only to apps that need them for their main function. On recent phones a coloured indicator in the status bar shows when they are in use: if it appears while you are not using any app that should be recording, check which app is accessing them.
Contacts
Giving access to your address book means sharing data about other people, who have given no consent. Many messaging and social apps use your contacts to suggest connections: consider whether you really need that feature.
Photos and files
Recent versions of Android and iOS let you grant access to selected photos only rather than the whole gallery. For an app that needs to upload a profile picture, that is the sensible choice.
How to review permissions
On Android
In Settings, under the privacy or apps section, you will find the permission manager: for each permission you can see the list of apps that have it. Many versions also offer a dashboard showing which apps used location, camera and microphone in recent hours. Android can also automatically remove permissions from apps you have not used for a while.
On iPhone
In Settings, under Privacy & Security, each category (Location Services, Contacts, Photos, Microphone, Camera) shows the authorised apps. The App Privacy Report, if enabled, records when apps access sensitive data and features. There is also a setting to ask apps not to track you across other companies' apps and websites.
A simple routine
- When installing, answer "Don't allow" or "Only this time" when unsure: the app will ask again when the permission is really needed.
- Every few months, go through the permissions list by category, starting with location, microphone and contacts.
- Uninstall apps you do not use. A forgotten app with broad permissions is a pointless risk.
- After a major system update, check again: new permission categories sometimes appear.
A concrete example
You install a document scanning app. On first launch it asks for the camera, location and contacts. The camera is essential; location serves, at most, to add the place to the document's metadata, which you rarely need; contacts might help share the file, but you can do that with the system share function without giving access to your whole address book. You grant only the camera: the app works just the same.
In short
- Permissions are the practical tool for applying the data minimisation required by the GDPR.
- Always ask whether a permission is relevant to the feature you are using.
- For location, prefer "while using the app" or approximate location.
- Giving access to contacts means sharing other people's data.
- Review permissions regularly and uninstall apps you do not use.