App Permissions Settings: Audit Checklist for iPhone/Android

Your phone has been quietly collecting "yes" answers for years — yes to location, yes to the microphone, yes to your contacts — and most people never go back to check which apps still have that access or whether they actually use it. Reviewing your app permissions settings doesn't take long, and both Apple and Google have built tools that make the job faster than scrolling app by app. Here's where those settings live, what to check first, and how to make the review repeatable.

Where do I find app permissions settings on my phone?

On an iPhone, permissions sit inside the Privacy & Security section of Settings. Apple's own guide describes reviewing "the list of data types (for example, Calendars, Contacts, Photos, Reminders, and so on)" and checking which apps have access to each one. An app only shows up in that list after it has actually asked for the permission: as Apple puts it, "An app doesn't appear on the list until it asks for permission, and you can grant or remove permission from any app that has asked for access." That's the category view — pick a data type, see every app that has asked for it, and flip any of them off.

On Android, there are two doors into the same information. For a single app, Google Play Help describes the path through Settings > Apps, choosing the app, and then tapping "Permissions" to see and change what it can access. For a sweep across every app at once, Android has a dedicated Permission manager reached through Security and Privacy settings, which lets you "check which apps have the same permission setting. For example, you can check which apps have permission to view your calendar," according to the same Google Play Help page. If you're on Android and want the fuller device-level walkthrough, our Android-specific privacy settings guide covers more of that menu.

How do I audit all my app permissions at once?

There are really two ways to do this, and they're not the same job.

By category: pick a sensitive permission — say, Location — and look at every app that currently has it. This is the fastest way to catch apps with no obvious reason to know where you are. Apple's category list and Android's Permission manager both work this way; the Permission manager breaks out categories including Camera, described as letting an app take pictures and record videos, Contacts, and Files, which can access all files on the device, per Google's documentation.

By app: if one app concerns you — maybe it asked for something unexpected, or you don't remember installing it — go straight to that app's own permissions screen and review everything it has, not just one data type. On Android this is the Settings > Apps > [app name] > Permissions path above. On iOS, you can scroll an individual app's settings page to see the full set of toggles it controls.

Doing a category sweep first, then following up on specific apps, covers both which apps hold your location data and whether an unfamiliar app has access it shouldn't.

Which app permissions should I check first?

Not every permission carries the same risk, so start with the ones that expose the most about you: location, camera, microphone, and contacts. These are also the permissions where Android gives you more than a simple on/off switch. According to Google Play Help, the levels are:

• All the time — for location only, this lets the app use the permission even when you're not actively using the app.
• Allow only while using the app — the app can use the permission only while it's open and in use.
• Ask every time — every time you open the app, it asks to use the permission, and it can use that access until you've finished using the app.
• Don't allow — the app is blocked from using the permission, even while it's open.

For most apps, "while using" or "ask every time" is enough — few apps genuinely need location all the time. If you've already granted that top tier to something that doesn't need it, dial it back. iPhone users get a comparable set of location choices — Ask Next Time, While Using the App, or Always — on an app's own Location entry. Android 11 also added a one-time option for location, microphone, and camera requests specifically; when an app requests one of those, the permissions dialog offers an "Only this time" choice, according to Android Developers — worth choosing instead of a blanket grant when you're trying out a new app. If photo location data is a specific worry, our location privacy guide covers that separately from app permissions.

Contacts and background data deserve the same scrutiny: does an app actually need your address book or the ability to run in the background? If you can't answer why, that's reason enough to turn it off and see if the app still works.

What is auto-reset for app permissions, and can I trigger it myself?

Android has a built-in mechanism that does some of this cleanup for you. Introduced in Android 11, auto-reset watches for apps you've stopped using and strips their sensitive permissions automatically. As Android Developers explains, "If your app targets Android 11 or higher and isn't used for a few months, the system protects user data by automatically resetting the sensitive runtime permissions that the user had granted your app." The effect is the same as if you'd manually gone in and switched the app's access to Deny, per the same source.

Google Play Protect runs a related version of this with a specific timeline: "Google may reset any permissions you grant from apps that you haven't used for 3 months," according to Android Help. That particular feature "protects devices that run on Android versions 6.0–10," and it doesn't touch everything — apps "needed for the usual operation of your device" are exempt. If an app you rarely open suddenly stops working the way it used to, this may be why; you'll need to grant its permissions again manually, per the same source.

You can also trigger a version of this yourself for any app, rather than waiting on the system. In an app's permissions screen on Android, there's an "unused app settings" section where you can turn on a setting to pause the app's activity if it goes unused, per Google Play Help — a manual switch distinct from Play Protect's automatic reset.

How do privacy dashboards show what apps are actually doing?

Granted permissions and used permissions are two different things, and both Apple and Google now have tools that show the difference.

On iPhone, the App Privacy Report shows "how often each app accesses your data (for example, your location, camera, and microphone)," according to Apple's guide. It has to be turned on manually, stays on the device, and covers a short window: "The data in your App Privacy Report is encrypted and stored only on your device. The report shows how many times—and when—an app accessed privacy-sensitive data or device sensors in the past 7 days." Separately, App Tracking Transparency is its own toggle covering cross-app tracking rather than individual feature access — Apple describes it as letting you "decide whether an app can track your activity across other companies' apps and websites," and you can withdraw that anytime.

On Android, the Privacy Dashboard does something similar: "you can see which apps are accessing data, which permissions apps are using, and when that access is happening," per Android Help. To reach it, open Settings, tap Security and Privacy (or Privacy on some devices), then tap Privacy dashboard; from there you can select the permission you're concerned about and tap on one of the listed apps to update it directly, according to the same source. The lookback window depends on your Android version — you can "check app activity for the last 7 days in Android 13 or 24 hours in Android 12," per the same Android Help page.

How often should I review my app permissions?

Apple frames a review as something prompted by a specific event — for instance, "if someone else set up your device or had access to it and knows your passcode," so you can confirm "they haven't changed your settings," per Apple's guide. Neither Apple nor Google publishes a recommended review schedule, so treat the cadence below as our own practical suggestion, not an official rule: a short check after installing several new apps, after lending your phone to someone, or simply a few times a year is enough to catch most drift.

The checklist

1. Open your category view — Privacy settings on iPhone, or the Permission manager on Android — and pick one high-risk category (location, camera, microphone, or contacts) to review first.
2. For each app listed under that category, decide if it still needs the access; revoke anything you can't justify.
3. On Android, downgrade location permissions from "All the time" to "Allow only while using the app" wherever constant tracking isn't needed.
4. Use "Ask every time" or iOS's While Using option for apps you use occasionally, instead of leaving them on a standing grant.
5. Check Android's Privacy Dashboard or iPhone's App Privacy Report to see which apps actually accessed sensitive data recently, not just which ones are allowed to.
6. On Android, confirm auto-reset is working for apps you haven't opened in months, or turn on the pause-if-unused setting yourself for any specific app.
7. Repeat the category sweep for the other high-risk permissions — camera, microphone, contacts, background data — one at a time.
8. Spot-check any single app that concerns you individually, reviewing its full permissions list rather than just one category.
9. Set a reminder to repeat the whole process periodically, since neither platform does this automatically for every app.