How to audit your app permissions in one sitting

You can audit every app permission on your phone in about twenty minutes per platform: open the permission manager, walk each sensitive category — location, camera, microphone, contacts, photos — and cut each app back to what it functionally needs, then delete the apps you no longer use, which is the permission reset that requires no toggles at all. The habit matters because permissions are granted in a two-second dialog and then never revisited: years later, a flashlight successor, a dead game, and a shopping app you tried once still hold whatever they asked for in 2021.

Why permissions deserve a yearly pass

Because permission grants are permanent until you revoke them, and apps change hands. A modest utility acquired by an ad-tech company becomes a data-collection asset with pre-granted camera and contacts access; a developer pivoting to "insights" monetizes location history nobody remembers approving. Regulators have repeatedly pursued exactly this pattern — the FTC's cases against apps misusing sensitive permissions, including health-adjacent data and children's data, make the stakes concrete. And deletion is the underrated half of the audit: an uninstalled app's permissions are gone along with its background access, which beats a dozen toggles on an app you stopped using.

Android: the permission manager walk

Paths vary slightly by version and manufacturer skin.

1. Open Settings > Privacy > Permission manager (on Pixel: Settings > Security & privacy > Privacy > Permission manager).
2. Work through the sensitive categories in this order: Location, Camera, Microphone, Contacts, Photos and videos, Files, Nearby devices. In each, the apps are grouped by grant level — "Allowed all the time" first.
3. Tap each app and cut it down: Don't allow where there is no conceivable need, Ask every time or Only while using otherwise.
4. Then Settings > Apps, sort by least-recently-used, and uninstall everything you have not opened in six months — games, one-off tools, apps whose events passed.

iPhone: the settings walk

1. Open Settings > Privacy & Security.
2. Work the categories: Location Services, Contacts, Photos, Camera, Microphone, Bluetooth, Local Network, Motion & Fitness. Each lists every app that has ever asked and its current grant.
3. In Location Services, prefer While Using and switch off Precise Location for apps that need only a city; reserve Always for almost nothing.
4. For Photos, prefer Limited Access — apps see only the pictures you select — over full-library access, which many apps request by default.
5. Then Settings > General > iPhone Storage (or just the App Library), and delete the long-unused apps; iOS offers an offloading option that keeps data while removing the app itself.

What are the judgment calls?

A few patterns cover most decisions. Messaging and social apps genuinely need camera and microphone in use — keep those, cut their contacts access unless you use contact-syncing deliberately (that syncing uploads your friends' data too, which is a decision about them, not just you). Shopping apps rarely need location at all — delivery address typed at checkout suffices. Games need almost nothing; any game holding microphone or location has explaining to do. Banking apps occasionally use camera for check deposits — that is legitimate; their location access usually is not necessary. Utility apps — flashlights, QR scanners, PDF tools — are the historic worst offenders and the safest to strip bare. When in doubt, revoke and see what breaks: apps re-prompt politely when they truly need a permission, which is the system working as designed.

What about browser and desktop apps?

The same principle applies with different doorways. Browsers hold site permissions — camera, microphone, location, notifications — under the site-settings menu; audit them the same way, keeping video-call sites' camera access and clearing the rest. Desktop apps request accessibility, screen-recording, and full-disk access on macOS under System Settings > Privacy & Security — where old helpers and abandoned tools accumulate grants that amount to reading everything you type; that list deserves the same annual walk. Set a yearly calendar reminder and pair the audit with your other security maintenance — twenty minutes now, a smaller footprint for the year.