What are permissions, and why do they matter for an app?

Mobile apps often request different types of permission in order to work optimally and offer users a better experience. These permissions give the app access to specific functions or data on the device that may be necessary for the app’s functionality.

One of the most common types of permission is access to the device’s location. This allows apps to deliver location-based services, such as navigation or location-based recommendations. Location permissions can be either precise, using GPS among other sources, or approximate, where only a rough position is shared.

Another frequent permission is access to the camera. This is necessary for apps that require photo or video recording, such as social media platforms or photo apps. Once granted, the permission allows the app to use the camera while it is in use, and both iOS and Android show an indicator when the camera is active, so that it is not used without the user’s knowledge.

In addition, many apps request access to contacts. This is particularly relevant for communication apps that want to synchronise with the user’s contact list to make connections and interactions easier. Access to contacts can also be used to suggest friends or connections based on existing contacts; on iOS, the user can choose to share only selected contacts.

Compared with more invasive permissions, such as access to text messages or call logs, these common permissions are designed to improve the app’s functionality and user experience while still respecting the user’s privacy. It is important for users to be aware of which permissions they grant and to make sure they are comfortable with the level of access they give an app.

Users can manage app permissions on their devices by going to the device’s settings, where they can get an overview of all installed apps and the permissions each app has been given. This allows users to adjust which data and functions each app can access, such as the camera, microphone, location and contacts.

Users are asked to grant permissions when an app needs them, but these can be changed at any time in the settings. For example, a user can choose to disable an app’s access to location services to protect their privacy or save battery. On Android, this is done via “Settings” > “Apps” > selecting the specific app > “Permissions”, while on iOS the permissions are found under the app’s name in Settings or under “Privacy & Security”.

Compared with earlier versions of operating systems, in which permissions were often granted permanently at installation, modern systems such as Android and iOS give users more control and flexibility. This is especially important at a time when data protection and security are in focus and users want to ensure that their personal information is only shared with apps they trust.

Giving apps too many permissions can involve significant security risks that can affect both privacy and data security. Here are three central risks associated with excessive permissions:

• Unauthorised access to personal data: When an app gets access to more data than necessary, the risk increases that sensitive information such as contacts, photos and location data can be misused. Apps can potentially collect and share this data with third parties without the user’s knowledge or consent, which can lead to breaches of privacy.
• Increased damage from malware and spyware: If a malicious or compromised app has extensive permissions, it can use them to monitor the user’s activities or steal data. The more permissions an app has, the greater the potential damage, which is why special permissions such as accessibility services are particularly sought after by malicious apps.
• Potential financial fraud: Permissions that allow apps to make calls or send text messages can be exploited for financial fraud. Unauthorised premium-rate messages or calls can result in unexpected costs for the user, especially if the app is compromised or developed with malicious intent. Google Play therefore restricts which apps may request SMS and call log permissions.

The combination of unauthorised data access, risk of malware and potential financial fraud underlines the importance of being selective about the permissions given to apps.

To ensure that apps only request necessary permissions, developers can implement a range of strategies that focus on security and the user’s privacy:

• Minimal permission requests: Developers should only request the permissions strictly necessary for the app’s core functionality. This can be achieved by reviewing the app’s features and identifying which permissions are critical to delivering the desired user experience.
• Context-based permissions: Permissions should be requested in the context of a specific action, where the user understands why the permission is needed. For example, a camera app can request camera permission when the user tries to take a photo.
• Use of standard APIs: Platform standard APIs, such as the system photo picker, often have built-in security measures and limitations that reduce or remove the need to request broader permissions.
• Transparency and explanation: Clear and easily understood explanations should tell users why a permission is needed and how it will be used. This can increase users’ trust and willingness to grant permissions.
• Regular review and updating: The app’s permission requirements should be reviewed and updated regularly to ensure that they are still relevant and necessary, and permissions no longer needed for the app’s functionality should be removed, including those added by third-party SDKs.
• User-centred design: The app should be designed with the user’s privacy in mind, and permission requests should be in line with best practice for user experience and privacy protection.
• Testing and feedback: The app should be tested thoroughly to ensure that it works correctly with the fewest possible permissions, including when permissions are denied, and feedback from users should be collected to identify potential concerns or problems with permission handling.

Overall, by focusing on minimal permission requests, context-based permissions, transparency and regular review, developers can ensure that their apps respect the user’s privacy and only request the permissions needed to deliver a secure and effective user experience.

Android and iOS handle app permissions in different ways, which affects both security and the user experience. These differences can matter for how users interact with apps and how their data is protected.

Android: The Android operating system allows users to manage app permissions in detail. Since Android 6, sensitive permissions have been requested while the app is running, and the user can choose to grant or deny specific permissions such as access to the camera, microphone or location. Android also allows users to change these permissions at any time via the settings. This gives users greater control over their data and how it is shared with apps. Android has also introduced features such as “Only this time” for temporary access to certain functions and approximate location, which increase privacy by limiting persistent access.

iOS: On iOS, app permissions have been restrictive from the start. When an app tries to access sensitive data or functions, such as the camera or location, the user is presented with a prompt where they can choose to grant or deny access. iOS also allows users to manage these permissions in the settings afterwards. iOS requires apps to state in Info.plist why they need each permission, and this explanation is shown in the prompt, helping users make informed decisions. iOS also offers features such as “Allow Once” and approximate location, letting users share a less precise location and further protecting their privacy.

Both systems have their own methods of protecting users’ data, and over the years they have moved closer to each other with runtime prompts, one-time permissions and approximate location. The differences lie mainly in details such as the categories of permissions and how background access is granted. The differences reflect each platform’s permissions model, that is, the rules for how and when an app can gain access to data and functions.

Permissions in an app are a critical element for both the user experience and trust, especially when it comes to access to personal data and device functions. When an app requests permissions, the user must first approve these requests. On modern devices, this happens through a system dialogue for each permission, typically when the function is needed, covering access to the camera, microphone, contacts, location and more. The user then decides whether to grant these permissions based on the app’s purpose and their own comfort with sharing data.

When the user accepts the permissions, the app can perform the functions that require them, improving the user experience by offering more personalised and functional services. The whole process takes place with the user’s consent, and the data shared is often protected through encryption and other security measures, safeguarding the user’s privacy and security. App developers must also ensure that the permissions are only used for the stated purposes and are not misused for unauthorised data collection.

This combination of user control over permissions, transparency in the use of data and strong security protocols helps ensure that the user can trust the app and its handling of personal data. It is crucial for app developers to strike a balance between functionality and privacy in order to build and maintain users’ trust.