What are app permissions and why do they matter?¶

App permissions control which device features and data an application is allowed to access.

What this means¶

Permissions may include location, camera, microphone, contacts, photographs, storage, Bluetooth, notifications and background activity.

They matter because they help explain what the app could potentially do.

An app with location permission may be able to collect location data.

An app with contact access may upload or compare the device address book.

An app with microphone permission may record audio when the user activates the relevant function.

Permissions can also be limited.

They may be allowed only while the app is open, denied, granted once or restricted to selected data.

Operating systems may change permission behaviour over time.

Specialist examination or provider information may be needed to determine whether the permission was active during the relevant period.

Also consider system-level access.

Accessibility services, device-administration rights, VPN profiles or management permissions may give an app broader capabilities than ordinary permissions.

The operational takeaway is: permissions show capability, not completed activity. Use them to understand what the app could access, then look for logs, content and provider evidence showing what actually happened.

What to check or do next¶

• Investigators should record relevant permissions where they can be obtained without altering the device.

Evidential limits¶

But permission does not prove use.

The fact that an app could access the camera does not prove that it took a photograph.

A location permission does not prove that location was collected at every moment.