Installing an app takes twenty seconds. The permissions it collects during those twenty seconds can outlive the app, follow you between devices and end up in a data broker’s file long after you have forgotten the icon ever existed. A photo editor asking for contacts, a game with microphone access, a shopping app that wants background location — none of that is rare in either app store.
The audit below takes about twelve minutes per app and covers iOS and Android separately, because the menu paths moved in recent versions and half the advice online still describes the old ones.
Start with the system permission screen, not the app’s own settings
Ignore anything inside the app for now. The operating system’s permission list is the layer that actually enforces a limit, and it cannot be argued with by the app’s marketing department.
iOS 18 and later: Settings → Apps → [app name]. Every permission that app holds sits on one screen — Location, Contacts, Photos, Microphone, Camera, Local Network, Tracking. On iOS 17 and earlier the same pages sat directly under Settings, one level up, so a guide written before 2024 will send you to the wrong place.
Android 13 and later: Settings → Apps → [app] → Permissions shows what this one app holds. The reverse view is more useful: Settings → Security & privacy → Permission manager (Privacy → Permission manager on Android 12) lets you pick “Location” or “Microphone” and see every app with that access at once. That view catches the apps you installed in March and never opened since.
Turn off tracking and clear the advertising ID
iOS: Settings → Privacy & Security → Tracking, then switch off “Allow Apps to Request to Track”. New apps stop being able to ask at all, but existing grants stay live, so scroll the per-app list below the toggle and turn off anything you do not actively want following you.
Android: Settings → Security & privacy → Ads, then tap “Delete advertising ID”. Apps receive a string of zeros instead of a stable identifier. Some manufacturers bury this under Privacy → Ads, and on older builds it is called “Reset advertising ID” with an opt-out switch.
Neither switch removes ads. Both remove the identifier that links your behaviour in one app to your behaviour in another, which is the part that turns a free game into a profile.
Trim location, photos and the sensors people forget
- Location. Set every app to “While Using” or “Ask Next Time”, never “Always”. On iOS, turn off Precise Location for weather, shopping and news apps — a three-kilometre approximation is plenty for a forecast.
- Photos. iOS offers Limited Access, where you pick the individual images an app may see. Android 14 and later has the same idea as “Select photos and videos”. Use it for anything that is not a gallery or a backup tool.
- Microphone and camera. iOS paints an orange dot in the status bar while the mic is live and a green one for the camera. If a dot appears on the home screen, open Control Centre and read which app is responsible.
- Local Network (iOS only). A shopping app has no reason to enumerate devices on your Wi-Fi. Deny it.
- Contacts. Deny by default. Address-book upload is how a “find friends” feature converts your friends’ phone numbers into somebody else’s marketing list.
Android’s Privacy dashboard (Settings → Security & privacy → Privacy dashboard) draws a 24-hour timeline of camera, microphone and location use, with a bar per permission. It is the quickest way to catch an app polling your location every fifteen minutes in the background.
Read the privacy report once a month
iOS 15 and later ships App Privacy Report: Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report. Give it a week and it lists which apps touched sensitive data and which domains they contacted. A social app reaching forty analytics domains is ordinary. A calculator reaching any is not.
Keep the review short and repetitive. Pick the ten apps you installed in the last ninety days, then run the same order monthly: check Permission manager for new grants, check who has background location, skim the privacy report, and delete anything unused for thirty days. Uninstalling is the only permission change that is genuinely permanent.
Two permissions that cause the most regret
The first is background location granted to a retail or delivery app, because it keeps a position history even when the app is closed and is the permission most often sold onward. The second is photo library access granted in full to an app that only needs one image to upload — it can then read the EXIF data on every picture, including the GPS coordinates of where each was taken.
For the login side of the same problem, see our guide to passkeys on your phone; for a deeper Android walkthrough, the 15-minute Android permissions audit goes app by app. Google documents the exact per-app paths at Change app permissions on your Android phone.