What Permissions Should a Free App Actually Need?

The core idea is not complicated, even though the permission screens themselves often are: a permission should match a feature you can point to. If an app can explain in one sentence why it needs a permission, and that sentence is about something the app visibly does, the request is reasonable. If the explanation requires guessing, or the permission has nothing to do with what the app is for, that is worth noticing.

This is a simple test, but it is one most people never actually apply, because permission prompts are designed to be tapped through quickly. Slowing down for ten seconds the first time you install something is most of the work.

The rule: permission should match function

A translation app that uses your camera to read text on a menu or a sign needs camera access — that is the feature working as advertised. The same app asking for your contacts list has no visible reason to. Translation does not require knowing who you know. When a permission request has no line back to a feature, the honest assumption is that it exists for something other than the feature you installed the app for, usually data collection for advertising or analytics.

Permissions commonly asked for without a good reason

A handful of permissions get requested far more often than the apps asking for them can justify. Being able to name these makes the pattern easier to spot.

• Location, requested by apps with no navigation, weather, or location-tagging feature. Often used to build an advertising profile rather than to run anything you asked for.
• Contacts, requested by apps with no messaging, calling, or explicit "find friends" feature. A translator, a wallpaper app, or a calculator has no legitimate use for your contact list.
• Storage or full media access, requested more broadly than a single feature needs. An app that only needs to save one exported file does not need open access to every photo on your phone.
• Microphone or camera access requested at launch, before you have touched any feature that would use it. A legitimate use asks for the permission at the moment the feature is used, not on first open.

None of these permissions are inherently suspicious — plenty of apps have good reasons for each one. The pattern to watch for is the permission arriving disconnected from any visible feature, or arriving in a bundle at install time rather than at the moment a specific feature actually needs it.

How to check what an app already has

Most people never revisit permissions after the initial install, even though what an app can access is easy to check at any time. On Android, this takes under a minute per app.

1. Open Settings, then Apps, then select the app you want to check.
2. Tap Permissions to see everything it currently has access to.
3. For each one, ask the one-sentence question: which feature needs this?
4. Revoke anything you cannot connect to a feature you actually use. Most apps keep working fine with a permission removed; if a feature breaks, the app will usually prompt you to re-grant it, and you can decide then whether that trade is worth it.
5. Do this pass every few months, since permissions granted for a feature you no longer use tend to linger unnoticed.

This is worth doing across your whole phone occasionally, not just for one app in isolation. It is common to find permissions granted a year ago for a feature you tried once and never used again.

Fewer permissions is a real signal of trustworthiness

For a small or independent app in particular, a short permission list is meaningful information, not just a technicality. A large company can absorb the cost of a data breach or a privacy scandal. A small studio generally cannot, and does not have the infrastructure to responsibly manage data it does not need in the first place. The safest data, for both the app maker and the person using it, is data that was never collected.

This is also just a simpler way to build software. An app that does not ask for your contacts does not need a policy about how it stores or protects your contacts. Every permission not requested is a category of risk, a category of code, and a category of promise the developer does not have to make and does not have to be trusted to keep.

None of this means every permission request from a small developer is automatically fine, or that every one from a large company is automatically suspect. It means the match between a permission and a visible feature is the thing worth checking, regardless of who built the app. It takes ten seconds and it tells you more than the star rating does.