Every time you click “Allow” on a permission prompt in Chrome — location, camera, microphone, notifications — that site gets permanent access until you manually revoke it. Permissions don’t expire, and Chrome doesn’t remind you they exist. Over a couple of years of browsing, most people have dozens of sites with permissions they forgot they granted. For a broader walkthrough, our How to Manage Google Chrome is a good next read.
Chrome’s site permissions are split across several places in settings. This guide shows where all of them live and how to configure each one effectively.
The main permissions hub
Navigate to chrome://settings/content — this is the complete list of all permission types Chrome manages. The most important ones to review:
- Location — which sites can see your physical location
- Camera — which sites can activate your webcam
- Microphone — which sites can access your microphone
- Notifications — which sites can send desktop notification alerts
- Popups and redirects — which sites can open new windows or tabs
- JavaScript — normally allowed everywhere; restricting it breaks most sites
- Clipboard — which sites can read or write your clipboard
- Background sync — whether sites can sync in the background after you close them
Click any permission type → see the global default setting (“Sites can ask” vs “Blocked for all sites”) and the individual exceptions list showing which specific sites are Allowed or Blocked.
Reviewing existing permissions site by site
Chrome also lets you see all permissions granted to a single site. Click the lock icon (or info icon) in the address bar while on any website → Permissions. This shows every permission that site has been granted or denied.
To see a complete list of all sites with any active permissions: chrome://settings/content → scroll down → “Additional permissions” → “All sites” at the very bottom. This view shows every site Chrome has stored any setting for, with a usage summary. Filter by date or search for a specific domain.
Notifications — the most abused permission
Notification permission is the one most sites try to get you to grant, because it lets them send advertising-style messages directly to your desktop. A quick review usually finds 15-30 sites with notification access that you may not have consciously intended to grant.
chrome://settings/content/notifications → scroll through “Allowed to send notifications” → remove any that aren’t clearly useful. Revoke permissions by clicking the trash icon or the three-dot menu next to each entry.
For future control: “Sites can ask to send notifications” is the default. Consider changing this to “Don’t allow sites to send notifications” → this blocks the prompt from appearing on new sites entirely. Sites you genuinely want notifications from (calendar apps, messaging services) can be added manually to the allowed list.
Location — when to allow and when to block
Location access makes sense for maps, weather apps, and local search. It rarely makes sense for news sites, entertainment, or e-commerce — those sites request location for advertising purposes rather than to genuinely serve you location-relevant content.
chrome://settings/content/location → default: “Sites can ask.” Each time a site requests location, you see a prompt to allow once, allow always, or block. “Allow this time” is the safest choice for most requests — it grants access for the current session only and doesn’t add the site to the permanent allowed list.
Review the “Allowed to see your location” list periodically. Mapping services and weather sites: reasonable. An e-commerce or news site: revoke.
Camera and microphone — the sensitive ones
These permissions deserve the most attention because misuse is most consequential. A site with camera access can activate your webcam without a visible indicator (though Chrome does show a recording indicator in the tab).
Default “Sites can ask” is the appropriate setting — you want to be prompted rather than have all sites blocked by default (video calls wouldn’t work) or all sites allowed by default (no protection at all). The prompt appears the first time a site requests access; your choice is saved for that domain.
Review the allowed list at chrome://settings/content/camera and chrome://settings/content/microphone. For most people: video conferencing tools (Zoom web, Google Meet, Teams) should be there. Random websites should not. Remove anything unexpected.
Our guide on Chrome settings and profile management covers related configuration areas, and our article on Chrome privacy settings covers the broader data management picture. For Chrome’s complete permissions reference including less-common types, Google’s Chrome Help documentation covers every permission type and its technical implications.
Cookies and data permissions
Cookies technically function as a permission layer. Chrome’s cookie settings control whether sites can store data in your browser and what kind:
- First-party cookies: set by the site you’re on. Needed for logins, shopping carts, preferences. Blocking these breaks most sites.
- Third-party cookies: set by embedded resources from other domains (ad networks, analytics). Used for cross-site tracking. Blocking these (chrome://settings/cookies → “Block third-party cookies”) has minimal effect on most site functionality.
- Site data: beyond cookies, includes localStorage and IndexedDB. Can store significant amounts of data in your browser from each site.
To see exactly what a site has stored: lock icon → Cookies → expands to show every cookie, its expiry, and its content. You can delete individual cookies or all cookies from a site from this panel. Useful for forcing a site to “forget” your session without clearing all cookies browser-wide.
Less-common permissions worth knowing
Clipboard (read): sites can request the ability to read your clipboard — meaning they can see whatever you’ve copied. Password managers and note-taking apps may legitimately request this; random websites shouldn’t. chrome://settings/content/clipboardRead → review carefully.
Background sync: allows sites to finish tasks after you’ve closed them — useful for email clients that need to send a message you composed. Less useful for news sites that use it for analytics. chrome://settings/content/backgroundSync → default is allowed; consider changing to “Sites can ask.”
Payment handlers: controls which sites can handle payment requests. Legitimate for payment services; otherwise can be used to intercept payment flows. Default is “Sites can ask” which is appropriate.
MIDI devices: allows sites to communicate with musical instruments connected via MIDI over USB. Rarely needed for general browsing. If you’re not a musician: blocking by default is fine.
Configuring permissions for individual sites
Sometimes you want a site to have different settings than the global default. Right-click anywhere on a page → “Inspect” won’t help here — instead use the lock icon in the address bar while on that site → Site settings. This opens a dedicated settings page for that specific origin showing every permission and its current state for just that domain.
This is more efficient than navigating to each permission type and searching for the site there. For example: if you want to allow notifications specifically from your project management tool but nowhere else, open that tool → lock icon → Notifications → Allow. The setting applies only to that domain without changing the global default.
Resetting all permissions — the clean slate option
If the permission settings have become complicated or you want to start fresh: chrome://settings/content → each permission type has a “Reset permissions” option that clears all saved site-specific decisions for that type. Sites that previously had access will need to ask again.
The most useful clean reset: clear Notifications permissions (removes all allowed sites), then set the default to “Don’t allow sites to send notifications,” then manually add back the few sites you actually want notifications from. This is faster than reviewing 30 sites individually.
| Permission type | Recommended default | Review frequency |
| Notifications | Don’t allow (ask is default but invasive) | Quarterly |
| Location | Sites can ask | Quarterly |
| Camera | Sites can ask | Annually or when video apps change |
| Microphone | Sites can ask | Annually or when video apps change |
| Popups | Blocked (Chrome default) | Only when a specific site needs exceptions |
| Clipboard (read) | Sites can ask | When you notice a site requesting it |
| JavaScript | Allowed (don’t touch this) | N/A — changing it breaks most sites |
Site permissions are one of those settings areas that work best when reviewed occasionally rather than configured once and forgotten. Chrome adds new permission types as web capabilities expand, and sites acquire permissions over time as you use them. A 5-minute review every few months keeps the list clean and ensures only the sites you actually trust have access to sensitive features.
The address bar lock icon is the fastest access point for per-site permission review — you see the permissions for whatever site you’re currently visiting without navigating away. For the overview of all sites with any permission: the “All sites” view in chrome://settings/content gives you the complete picture in one place.
Extensions and their own permission system
Chrome extensions have a separate permission system from site permissions. Extensions request access to your data when you install them (or sometimes on-demand when you first use a feature). These permissions are managed at chrome://extensions → click “Details” on any extension → see what permissions it holds.
Common extension permission levels:
- “Read and change all your data on all websites”: the broadest permission — the extension can see and modify any page you visit. Ad blockers and password managers legitimately need this. Unknown or rarely-used extensions probably shouldn’t have it.
- “Read and change your data on specific websites”: more targeted. The extension only operates on specific domains.
- “When you click the extension”: only activates when you manually click the extension icon. The most privacy-preserving mode for extensions that don’t need to run constantly.
You can limit some extensions to “On click” mode: right-click the extension icon in the toolbar → “This can read and change site data” → “When you click the extension.” Not all extensions function correctly in this mode, but many do. Worth trying for extensions you use occasionally rather than constantly.
Permissions in Chrome for work or school accounts
On Chrome instances managed by an organisation: some permission settings are locked by policy. You’ll see “Managed by your organisation” labels next to settings that IT controls. In these environments, the IT admin can pre-grant certain permissions (like allowing the company intranet to use the microphone for internal video calls) or pre-block others (like preventing certain sites from accessing location).
If a permission setting is greyed out or you see a policy banner: you can’t change it locally. Check with IT if the current configuration prevents something you need for legitimate work purposes — they can add exceptions at the policy level that apply to your device.
Understanding Chrome’s permission model fully — from the global defaults, to per-site exceptions, to extension permissions, to managed policy overrides — gives you complete visibility into what has access to what on your machine. Most of this is visible in chrome://settings/content without needing any technical background; it just requires knowing it’s there and taking 10 minutes to look through it.
Automatic permission revocation for inactive sites
Chrome has a feature that can automatically revoke permissions for sites you haven’t visited in a long time. This applies specifically to installed web apps (PWAs) rather than regular sites, but it’s useful to know it exists.
For regular sites: Chrome doesn’t automatically expire permissions. A notification permission granted to a site 3 years ago is still active today unless you revoke it manually. This is why periodic review matters — permissions accumulate silently as you browse.
An alternative approach for privacy-conscious users: use a Chrome extension like “Permission Audit” or manually script a permission review into your browser hygiene routine. Some privacy-focused extensions also automatically revoke permissions for sites that haven’t been visited recently, applying the automatic expiry behaviour that Chrome’s built-in system doesn’t provide for regular sites. Our guide on How to Manage Chrome Extensions covers an adjacent issue.
One last practical point: when you visit a site and decline a permission prompt, Chrome remembers that “Block” decision just as it remembers “Allow” decisions. If you later want to grant the permission you originally denied: you’ll need to manually update it because the site’s prompt won’t appear again. The lock icon in the address bar → Notifications (or Location, etc.) → change to “Ask” → the site can then prompt you again the next time it needs the permission. This is the fix when a site that needs location access (like a maps service) stopped asking because you clicked Deny too hastily. See also How to Manage Chrome Site Permissions for a related case.
