What Permissions Should You Not Allow on Android Apps
Last verified: October 14, 2026
There is no universal deny list — the right answer always depends on what the app actually does. But most of the permissions below are dangerous enough, and rarely needed enough, that your default should be to deny them and only allow them if you understand exactly why the app is asking. Start from “no” and make the app earn each one.
A useful rule: if the app’s job has nothing to do with the permission, deny it. A flashlight app has no business reading your texts. A wallpaper app has no business tracking your location.
The permissions to almost never allow
SMS and call logs
Permissions: SMS, call log access
Almost no consumer app needs to read your texts or see who you called. These permissions give an app access to login codes, private conversations, and your contact patterns. The common excuse — “we need SMS for verification codes” — doesn’t hold up: Android lets apps read verification codes automatically without full SMS access.
Deny it for: games, flashlights, wallpapers, media players, browsers, shopping apps, anything social that isn’t your actual messaging app.
The exception: your actual SMS app, your dialer, and backup apps you deliberately chose.
Accessibility
Permission: Accessibility service (found under Settings → Accessibility, not the normal permission list)
This is the most dangerous permission on Android. An Accessibility service can see everything on your screen, read what you type — including passwords — and tap buttons for you. Legitimate uses exist (screen readers, password managers with auto-fill), but it is the single most abused permission in Android malware.
Deny it for: any app that isn’t a screen reader, a password manager you trust, or an automation tool you installed on purpose. If a random game, “booster,” or utility asks for this, treat it as a red flag and consider uninstalling the app entirely.
Device admin
Permission: Device admin apps (Settings → Security → Device admin apps)
Device admin lets an app lock your screen, change your password, and — critically — block you from uninstalling it. Google deprecated it for most uses years ago, so legitimate apps rarely need it anymore. A sketchy app holding device admin can be very hard to remove.
Deny it for: everything except your employer’s device-management app (if you use one) and a trusted anti-theft tool like Find My Device.
Install unknown apps
Permission: Install unknown apps (Settings → Apps → Special app access)
This permission lets an app install other apps on your phone. Only a browser, a file manager, or an app store you trust should ever hold it — they need it for legitimate downloads. If a game or a “free VPN” asks for it, that’s a classic malware move: it’s asking for the right to install more malware.
Deny it for: anything that isn’t your browser, file manager, or a store you chose.
Draw over other apps (overlay)
Permission: Display over other apps
Overlay permission lets an app draw on top of everything else. This is how “tapjacking” attacks work — a fake login screen drawn over your banking app, or invisible buttons over real ones. Messengers and screen-dimming apps use it legitimately.
Deny it for: any app you don’t recognize, especially ones that popped up asking out of nowhere. If an app you just installed demands this before it will even open, be suspicious.
Access to all files
Permission: All files access / Manage external storage
Android 11 and later restrict most apps to their own files, and there’s a “photos and videos only” option for good reason. Full file access means the app can read everything: your documents, downloads, other apps’ exported data.
Deny it for: any app that works fine with the limited “photos and videos” option. Only file managers, backup tools, and antivirus apps you trust need the full version.
Notification access and usage access
Permissions: Notification access, Usage access (both under Special app access)
Notification access lets an app read the content of your notifications — including message previews and verification codes. Usage access lets it see which apps you open and when. Wellness and digital-wellbeing apps use these legitimately.
Deny it for: anything that doesn’t have an obvious reason. A “battery saver” reading your notifications is a data-collection tool wearing a costume.
The permissions to limit, not always deny
Some permissions are fine in the right context but dangerous when over-granted. Use the middle options Android gives you:
- Location: give “While using the app,” never “Always” — unless it’s a navigation, fitness, or family-safety app where background tracking is the point. Use “Approximate” instead of “Precise” whenever the app doesn’t need your exact spot (weather apps don’t need your doorstep).
- Camera and microphone: allow while using for video calls and camera apps; deny for everything else. On Android 12 and later, the green dot in your status bar tells you when they’re active — if the dot appears and you’re not using camera or mic, check which app is responsible.
- Contacts: most apps don’t need your address book. Allow it for messaging, dialer, and email apps; deny it for games, news apps, and shopping apps.
- Photos and videos: use “Select photos and videos” (Android 14+) instead of “Allow all” when an app only needs one picture.
The permissions most apps genuinely need
Don’t reflexively deny everything — apps need some permissions to function, and denying a legitimate one just breaks the app:
- Notifications: most apps you actually use need these.
- Storage/media access: scoped to what the app does (photos for a gallery app, music for a player).
- Nearby devices/Bluetooth: for headphones, wearables, and casting.
- Alarms and reminders: for clock and calendar apps.
What to do about permissions you’ve already granted
Android lets you revoke everything in one place:
- Go to Settings → Privacy → Permission manager.
- Tap a permission (Location, Camera, SMS, etc.) to see every app holding it.
- Change anything that looks wrong to Don’t allow, or Ask every time where available.
- Check the Special app access menu (Settings → Apps → Special app access) for Accessibility, Device admin, Install unknown apps, and Display over other apps — these don’t appear in the normal permission lists.
Do this review once every few months. It takes five minutes, and you’ll almost always find something you granted in a hurry and forgot about.
For the full walkthrough of how Android permissions work, see our guide on understanding app permissions before installing.
Quick reference: default to deny
| Permission | Default stance |
|---|---|
| SMS / call logs | Deny (except your SMS and dialer apps) |
| Accessibility | Deny (except screen readers, trusted password managers) |
| Device admin | Deny (except work device management) |
| Install unknown apps | Deny (except browser, file manager, trusted stores) |
| Draw over other apps | Deny for anything unfamiliar |
| All files access | Deny; use limited media access instead |
| Notification / usage access | Deny unless the app’s purpose requires it |
| Location | “While using” + approximate, never “Always” |
| Camera / microphone | While using for relevant apps; deny the rest |
| Contacts | Deny unless it’s a messaging, dialer, or email app |
FAQ
Can I break an app by denying a permission?
No — denying a permission can’t harm your phone. At worst, one feature of the app stops working, and Android will ask again when the app needs it. You can always re-allow it later.
Why does a flashlight app want my location?
It doesn’t need it. That’s the point — apps collect permissions they don’t need because the data is valuable. Deny it.
Should I use “Ask every time” or “Don’t allow”?
“Don’t allow” for permissions the app clearly doesn’t need. “Ask every time” for ones you might occasionally want (like location for a delivery app you use rarely). “While using the app” for permissions that match the app’s job.
What if an app won’t open until I grant a permission?
That’s a pressure tactic, not a technical requirement. Legitimate apps explain why they need a permission and keep working with limited access. If an app refuses to open without a dangerous permission, look for an alternative.
Is it safe to grant Accessibility to a password manager?
For a reputable password manager you installed yourself, yes — that’s one of the legitimate uses. The danger is granting it to apps you don’t know or didn’t deliberately choose.
This article is informational guidance. Android’s menus vary slightly by manufacturer — on Samsung, Xiaomi, and Pixel devices the settings may have slightly different names, but the permission lists are the same.