7 Permissions You Should Never Grant an Android App
Android's permission model is one of the strongest in the industry. The problem is not the system itself. It is the speed at which users tap through prompts to get an app working, especially when they downloaded something in a hurry to solve one specific problem. Understanding which permissions carry the most risk is the first step toward using your device without handing over more control than you intended.
The seven permissions covered in this guide
- Accessibility Service
- Device Admin
- SMS access
- Draw over other apps
- Contacts access for apps with no clear reason
- Background location and the "always allow" option
- Install unknown apps granted to the wrong application
Android's permission architecture has evolved into one of the most transparent systems on any consumer platform. Users can see exactly which apps have access to which capabilities, revoke permissions after the fact, and grant one-time access for sensitive features. The system itself is not the weak point. The weak point is human behavior, particularly the habit of tapping "allow" without reading, driven by the desire to get an app working as quickly as possible.
This guide examines seven permissions that deserve genuine scrutiny. The goal is not to create fear around every prompt, but to help you distinguish between permissions that make sense for an app's stated function and those that warrant a closer look. Needing a permission is not automatically suspicious. A flashlight app requesting camera access is logical because it needs the flash hardware. The question is always whether the permission aligns with the app's purpose and whether you trust the developer behind it.
Accessibility Service
Accessibility Service sits at the top of this list because of how much control it actually grants. The feature was designed for legitimate purposes: screen readers for visually impaired users, switch access for people with motor impairments, and other assistive tools that make smartphones usable for everyone. Those are important functions and the permission exists for good reason.
The same capability that lets an accessibility tool read screen content and simulate taps also lets a malicious app do exactly that. An app with Accessibility Service can observe everything displayed on your screen, including passwords as you type them, and can perform actions on your behalf without additional confirmation. Mobile security researchers have documented this permission as the primary mechanism behind most Android banking trojans in circulation. The typical attack pattern involves malware watching for a banking app to open, then displaying a fake overlay that captures credentials while simultaneously using accessibility controls to navigate the real app and initiate a transfer.
If an application requests Accessibility Service and its stated purpose has nothing to do with accessibility features, that request should be declined without hesitation.
Device Admin
Device Administrator access exists for corporate mobile device management and legitimate device-finding features. It grants an app the ability to perform high-impact actions such as forcing a factory reset, locking the screen remotely, or changing the device password. In an enterprise environment where IT departments manage hundreds of phones, this capability is essential.
Outside of that context, the permission is rarely justified. A utility app, a game, or any consumer application asking for Device Admin access with no clear explanation is a red flag. There is also a practical consequence: apps with Device Admin are significantly harder to uninstall because the permission must be revoked through system settings before the app can be removed through normal means. That difficulty is itself a signal of how much control the permission hands over.
SMS Access
Full SMS read and send access gives an application the ability to view every text message on your device, including one-time passcodes sent by banks, email providers, and other services that rely on SMS for two-factor authentication. It also allows the app to send messages on your behalf, which in the worst cases means silently subscribing your number to premium-rate services that appear on your phone bill.
The legitimate use cases for SMS access are narrower than the number of apps that request it. Messaging applications and a small set of verification tools have a reasonable claim to the permission. A game, a wallpaper app, or a photo editor asking for SMS access does not. This permission is also increasingly targeted by malware that intercepts two-factor codes to bypass account protections, making it one of the more consequential permissions on this list.
Draw Over Other Apps
This permission allows an application to display content on top of everything else on the screen, including other apps and system interfaces. For legitimate purposes such as call screening overlays or floating chat bubbles, the capability is useful and well-intentioned.
The same mechanism enables a technique known as tapjacking, where malware draws an invisible or convincing fake interface over a real application. The user believes they are tapping a legitimate button, perhaps confirming a permission or approving a transaction, while the actual tap registers on the hidden malicious layer beneath. The result is that users authorize actions they never intended, often without any indication that something went wrong.
Contacts Access for Apps With No Clear Reason
A messaging app or dialer needing access to contacts is entirely logical. The app cannot function without knowing who you communicate with. A calculator, a QR code scanner, or a simple puzzle game does not have that same justification.
This permission is less about direct device compromise and more about data harvesting at scale. Apps that request contacts access without a functional need are often uploading entire contact lists to build advertising profiles, map social networks, or in more malicious cases, fuel phishing campaigns targeting the people you know. The permission deserves scrutiny because the consequences extend beyond your own device to everyone in your address book.
Background Location and the "Always Allow" Option
Android now distinguishes between location access while an app is in use and location access at all times. That distinction matters more than most users realize. Very few applications have a legitimate reason to track location continuously, including when you are not actively using them.
Weather apps that provide local forecasts, fitness trackers that log routes in the background, and a small number of other tools can justify the "always allow" setting. Most apps requesting continuous location access are doing so for advertising purposes and behavioral profiling rather than any feature the user actually requested. Granting "while using the app" instead of "always allow" is almost always the better choice, and Android makes that option easy to select.
Install Unknown Apps Granted to the Wrong Application
This permission allows a specific app to install other APK files without going through the Play Store. For an alternative app store that you have deliberately chosen to trust, such as F-Droid for open source software, the permission is appropriate and necessary.
The risk emerges when the permission ends up granted to applications that should never have it, such as a browser, a file manager you rarely use, or a messaging app. In that scenario, a single compromised or malicious application becomes a pipeline for installing additional software on your device without your active involvement each time. An app that can silently install other apps effectively controls what runs on your phone.
A Practical Habit That Catches Most Problems
Before granting any permission beyond the absolute basics, pause and ask one question: does this specific permission serve the feature I am trying to use right now? If the answer is not immediately obvious, decline the request and observe whether the app still functions. A surprising number of applications request far more access than they actually need, and Android will typically keep core features working even when you deny permission. The app may show a prompt explaining why it wants the permission, which gives you more information to make a decision. If it refuses to work at all without an unrelated permission, that is useful information about the developer's priorities.
Where to Check and Manage Permissions on Your Device
You do not need third-party tools for most permission management. Android's built-in permission manager, found under Settings, then Privacy, then Permission manager, lets you view every app that has each type of permission, organized by category rather than requiring you to check each app individually. This view makes it easy to spot outliers, such as an app you installed months ago that has access to capabilities you do not remember granting.
Google documents the full permission model in detail on the official Android developer permissions guide, which is worth reviewing if you want to understand exactly what each permission category unlocks. For a broader perspective on how mobile threats abuse these permissions in real-world attacks, the ENISA threat landscape reports break down attack patterns across the industry, not just on Android.
Why These Permissions Matter More Than Most
The seven permissions covered here share a common characteristic: they grant capabilities that extend well beyond the app's own sandbox. Accessibility Service and Draw Over Other Apps allow interference with other applications. Device Admin grants control over the device itself. SMS access touches two-factor authentication, which is a cornerstone of account security. Background location and contacts access enable surveillance and data collection that follows you beyond the app. Install unknown apps opens the door to additional software you never explicitly approved.
None of these permissions are inherently malicious. Accessibility tools help people who need them, background location genuinely improves some applications, and Device Admin runs countless corporate phones without incident. The risk is granting them by reflex, to an app that has no real reason to need them, simply to get past a prompt faster. Slowing down on these seven specifically closes off the majority of ways a bad app actually does damage on Android.
A Note on App Stores and Sideloading
Permission decisions become even more important when installing apps from outside the Play Store. Google's review process is not perfect, but it does provide a baseline layer of scanning and policy enforcement that sideloaded APKs do not have. If you choose to install applications from third-party sources, the permission review process deserves even more attention, because you are relying entirely on your own judgment about the developer's intent.
The same principle applies to apps that were once trustworthy but changed ownership. An app can be sold to a new developer who updates it with different intentions, and existing permissions remain in place through the transition. Reviewing permissions periodically, not just at install time, catches these situations before they become problems.
Android gives you the tools to understand and control what apps can do on your device. Using those tools deliberately, rather than reflexively dismissing prompts, is the difference between a phone that works for you and one that works on you.