Every app on an iPhone requests access to sensitive resources — location, microphone, camera, contacts, photos, health data — and iOS asks for your permission when those requests are made. The problem: most users approve permissions in the moment without examining whether the app genuinely needs that access, resulting in a collection of apps holding permissions far beyond what they need to function. This fits into the wider topic we cover in our Complete Guide to Security and Privacy.
A thorough iOS app permissions audit typically takes under 30 minutes and immediately reduces the passive data collection happening on the device. It’s one of the most impactful privacy improvements available to iPhone users.
The permission categories worth auditing — in priority order
Location (highest priority): Settings → Privacy & Security → Location Services. Review per-app settings rather than disabling globally (which breaks legitimate apps like Maps). For each app, the options are: Never, Ask Next Time, While Using the App, and Always. “Always” — continuous background access — should be granted only to apps with a genuine background location need (actively-routing navigation apps, certain fitness trackers). “While Using” is appropriate for most apps that legitimately need location. Also check “Precise Location” per-app: weather apps don’t need GPS-level accuracy — neighbourhood-level is sufficient. Disable Precise Location for any app where exact position isn’t a functional requirement.
Microphone and Camera: Settings → Privacy & Security → Microphone (and Camera). Binary — Allow or Don’t Allow. The iOS indicator dot (orange for microphone, green for camera) in the status bar shows in real time when any app is accessing these. An orange dot appearing when an app is open but no recording function is active is worth investigating. Remove access from any app that doesn’t have a clear, obvious functional need for audio or image capture.
Contacts: Settings → Privacy & Security → Contacts. Granting Contacts access gives an app your entire contacts list — names, phone numbers, email addresses of people who haven’t consented to their information being shared with the app. Apps that should have Contacts access: Phone, Messages, Mail, WhatsApp, Signal, calendar apps with contacts integration. Apps that typically don’t: fitness apps, games, shopping apps, most utilities. Social media apps using Contacts for “find your friends” features are building social graphs they monetise from data you provided.
Photos: iOS offers “Selected Photos” — access to only the specific photos chosen rather than the entire library. Full Photos library access reveals the timestamps, locations, and subjects of every photo ever taken. For any app that holds “All Photos” access but only needs you to select an image occasionally, change this to “Selected Photos” — the app can still perform its function without reading the entire library. Settings → Privacy & Security → Photos → tap each app → change from “All Photos” to “Selected Photos.”
Bluetooth and Local Network: Settings → Privacy & Security → Bluetooth (and Local Network). Bluetooth access allows an app to discover nearby Bluetooth devices — used for legitimate purposes (connecting speakers, fitness devices) or for passive proximity tracking (retail analytics, advertising systems identifying nearby devices). Local Network access allows discovery of devices on the same WiFi network. Grant both only to apps with obvious functional connectivity needs — smart home apps, streaming apps, device pairing utilities.
The complete audit process
Work through each category in Settings → Privacy & Security using a simple question for each app: does this app have a function that genuinely requires this type of access? If the answer is unclear, default to removing the permission — the app can request access again the next time it genuinely needs it, giving you a more informed decision in that context.
| Permission | Apps that typically need it | Apps that typically don’t |
| Location (Always) | Navigation apps actively routing, specific fitness trackers | Essentially everything else |
| Location (While Using) | Maps, weather, delivery tracking, Uber/Lyft | Social media, games, shopping apps, news |
| Microphone | Phone calls, video calling apps, voice memos, Siri integrations | Most games, social media (unless you post video), shopping apps |
| Camera | Camera app, video calling, QR scanner, photo editing | Banking apps, news apps, games, most productivity apps |
| Contacts (Full) | Phone, Messages, Mail, messaging apps (WhatsApp, Signal) | Games, shopping apps, social media, fitness apps |
| Photos (All Photos) | Camera roll managers, full photo editing suites | Most apps — use “Selected Photos” instead |
| Bluetooth | Smart speaker apps, fitness device apps, smart home control | Most social media, games, productivity apps |
| Health | Dedicated health monitoring apps, fitness apps with health integration | Almost everything else |
The App Privacy Report — seeing actual access in real time
Enable at Settings → Privacy & Security → App Privacy Report → Turn On App Privacy Report. After a week of normal use, the report shows which apps accessed each permission category and when, plus which domains each app contacted.
Reading it effectively: look for apps that accessed permissions at unexpected times — a flashlight app that accessed location at midnight, a weather app that contacted advertising domains hundreds of times per day, or a photo editing app that accessed contacts without any obvious reason. These patterns reveal the data collection behaviour that occurs silently between active use sessions.
The domain data is equally revealing — it shows which advertising networks each app communicates with, independent of the permissions they hold. An app with no location permission can still share approximate location through IP-based geolocation transmitted to advertising networks. Identifiable ad networks, analytics platforms, and data broker services appear as domain contacts the user never explicitly authorised. Apps with extensive advertising domain activity warrant consideration of whether their utility justifies the tracking relationship.
Our guide on iPhone privacy settings covers the iOS privacy configuration beyond app permissions, including Safari settings, Siri, Apple ID privacy controls, and Advanced Data Protection. For Apple’s detailed documentation on how iOS app permissions work and what data each permission type enables, Apple’s iOS Privacy documentation lists every protected resource and the associated permission string developers must include when requesting access.
App Tracking Transparency — the cross-app tracking layer
App Tracking Transparency (ATT) is a separate but related iOS privacy control: Settings → Privacy & Security → Tracking → Allow Apps to Request to Track. When off, apps cannot even ask permission to track your activity across apps and websites owned by other companies for advertising targeting.
ATT controls whether apps can use the IDFA (Identifier for Advertisers) to link user behaviour across different apps and websites. The recommended setting: Off. Apps that request tracking when the master toggle is on should be evaluated individually — most users have no reason to allow advertising tracking from any app. Disabling ATT (or denying all tracking requests) significantly reduces cross-app behavioural profiling while having no effect on the apps’ core functionality.
Best practices for new app installs
A thorough audit covers existing apps. Good habits at install time prevent permission-creep from recurring:
- Review the App Store privacy label before installing. Each App Store listing includes “Data Linked to You” and “Data Used to Track You” disclosures. Self-reported rather than verified, but an app listing location, contacts, identifiers, purchase history, and browsing history as data linked to the user warrants more scrutiny than one listing only crash data.
- Always choose the most restrictive option at first launch. Choose “While Using” over “Always” for location. Choose “Ask Next Time” when uncertain. Choose “Selected Photos” over “All Photos.” Choose “Don’t Allow” for Bluetooth and Local Network until the app demonstrates a specific need. Permissions can be upgraded later if restricted access causes genuine limitations — the friction of upgrading is minimal; the friction of discovering a year of background tracking is not.
- Decline permissions that have no obvious functional relationship to the app. A flashlight app requesting location access has no legitimate reason for it. Decline and see whether the app functions without it — if it refuses to work without the permission, that refusal itself is informative.
Family and shared device considerations
iOS app permissions granted under a child’s Apple ID or on a shared device affect what that app can access on that device. A game installed under a parent’s Apple ID and granted All Photos access can access all photos taken by that Apple ID’s device — including family photos the child didn’t take.
iOS Screen Time parental controls (Settings → Screen Time → another family member’s device) include permission approval controls that allow parents to manage permission requests for children’s accounts. A quarterly review of iOS app permissions on all family devices — applying the same audit process to children’s devices — prevents unintended data exposure through children’s apps, which frequently have more invasive data collection practices than adult-targeted apps due to less regulatory scrutiny and higher-frequency permission requests during onboarding flows designed to be accepted quickly.
Permissions after iOS updates — the reset problem
Major iOS updates occasionally reset specific app permissions or prompt for re-confirmation. After any significant iOS update, a brief review of the most sensitive permission categories (Location, Microphone, Camera) confirms that previously-set restrictions are still in place. Some apps also trigger new permission requests after their own updates — when an app update introduces a new feature that requires a permission not previously requested, iOS presents the permission prompt at next launch.
These update-triggered prompts should be evaluated with the same care as initial install prompts — the update context doesn’t change the question of whether the app genuinely needs the access it’s requesting. An app that previously had no location permission requesting it after an update may have added a location-based feature (worth granting if the feature is genuinely useful) or may be expanding data collection through a new update (worth declining). Related: Privacy by Design.
The 15-minute quick audit — what to prioritise if you don’t have 30 minutes
If time is limited, this sequence covers the highest-impact iOS app permissions decisions:
- Location Services (5 minutes): Settings → Privacy & Security → Location Services → work through each app and change anything set to “Always” that doesn’t need continuous background access. Change to “While Using.”
- Contacts (3 minutes): Settings → Privacy & Security → Contacts → remove access from any app that isn’t a communication app or has no obvious need for your address book.
- Microphone (3 minutes): Settings → Privacy & Security → Microphone → remove access from any app with no obvious audio recording function.
- ATT toggle (1 minute): Settings → Privacy & Security → Tracking → “Allow Apps to Request to Track” → Off.
- App Privacy Report (2 minutes): enable it if not already on; note any immediately surprising results to investigate.
These five steps address the permission categories with the most active data collection by the most apps, in the shortest total time. The full audit adds Contacts, Photos (checking for All Photos vs Selected Photos), Bluetooth, Local Network, and Health — each taking a few additional minutes. The 15-minute version is significantly better than no audit, and it can be completed during any 15-minute window without requiring sustained focus. If this sounds familiar, iPhone Privacy Settings is worth a look.
iOS app permissions, reviewed quarterly and applied thoughtfully at each new install, produce a device that collects significantly less passive data than the typical iPhone that has accumulated permissions over years of casual approval. The goal isn’t to deny every permission — it’s to ensure that each permission is genuinely earned by a functional need rather than accumulated through friction-minimising default approvals that serve the app’s data interests over yours. Our guide on Android Privacy Settings covers an adjacent issue.
