Why Does Your Flashlight App Need Your Contacts? The Truth About Permission Overreach

At some point in the last few years, you've probably tapped "Allow" on a permission request without reading it. Maybe it was a food delivery app asking for your location — that makes sense. Or a photo editor requesting camera access — sure, fine. But what about the recipe app that wants your microphone? Or the puzzle game asking for your contacts? Or the free VPN requesting access to your calendar?

This is the permission paradox: apps routinely ask for access to data and hardware they have no obvious reason to touch, users routinely grant it, and almost nobody in the middle is asking why.

We spent several weeks digging into this — reviewing permission patterns across top-downloaded apps in the US, speaking with mobile security researchers, and analyzing publicly available data on what permissions apps request versus what they demonstrably use. What we found is a system built less around user needs and more around data acquisition strategies that most users would find uncomfortable if they understood them.

The Scale of the Problem

First, some context on how widespread this is.

A 2022 analysis by Incogni examined permissions across more than 1,000 popular Android apps and found that the average app requests 11 permissions — with a significant portion requesting access to data that had no clear connection to the app's core function. Location access was requested by apps in categories ranging from gaming to finance. Microphone permissions showed up in apps with no audio features whatsoever.

On iOS, Apple's permission framework is more granular and arguably better enforced, but the problem persists. Apps can request "approximate location" access even when precise location would be irrelevant to their function. Background app refresh, local network access, and tracking permissions are regularly requested by apps where the use case is murky at best.

"The gap between what an app requests and what it actually needs to function is often enormous," says Zara Liu, a mobile security researcher who has published work on Android permission abuse. "And that gap is rarely accidental."

The Real Reasons Apps Over-Request

So why do developers ask for more than they need? The answers fall into a few distinct categories, and they're worth understanding separately.

Insurance and future-proofing. Some developers request permissions at install time for features that don't exist yet. It's easier to ask once than to prompt users again later when a new feature rolls out. The logic is understandable from an engineering standpoint — but it means users are granting access to capabilities they can't evaluate because those capabilities haven't been built.

Third-party SDK requirements. This is probably the most underappreciated driver of permission overreach. When a developer integrates a third-party advertising, analytics, or attribution SDK — which the vast majority of free apps do — that SDK often comes with its own permission requirements. The developer may not even fully understand what data the SDK is collecting. They just know it needs location access or contact access to function, and they accept those terms because the SDK powers their revenue.

"The developer of a flashlight app probably isn't personally harvesting your contacts," explains Marcus Webb, a mobile privacy consultant based in Seattle. "But the advertising SDK they integrated might be. And by accepting the SDK's terms of service, the developer handed over access they didn't fully audit."

Data brokering pipelines. For some apps — particularly free ones in categories like utilities, weather, and VPNs — the data itself is the product. Location data is extraordinarily valuable to data brokers, who aggregate it and sell it to advertisers, insurers, financial institutions, and sometimes government agencies. A free weather app that requests precise location access every hour isn't just checking the forecast. It's building a movement profile.

Monetization optionality. Some permissions are requested speculatively — not because there's a current plan to use them, but because having that access creates future monetization options. If a company later decides to launch a targeted advertising product, they already have the data infrastructure in place. Users who granted permission years ago never consented to that future use.

The Permissions That Should Raise Your Eyebrows

Not all permission requests are created equal. Here's a quick breakdown of which ones deserve extra scrutiny:

Contacts access — Almost no app genuinely needs this unless it's explicitly a communication or social tool. When a utility app, game, or shopping app requests contacts, ask yourself: what would they do with 200 names and phone numbers?

Precise location (always on) — There's a significant difference between "while using the app" and "always." Always-on location is rarely necessary for anything short of a navigation or rideshare app. Any other category requesting background location deserves serious skepticism.

Microphone — Audio recording permissions are sometimes legitimately needed (voice memos, translation apps, accessibility tools). But they show up in apps with no audio features, which strongly suggests either SDK requirements or speculative data collection.

Photos (full library access) — iOS now offers photo picker access as an alternative to full library access, meaning apps can let you select specific photos without seeing your entire camera roll. If an app insists on full access rather than accepting the picker, that's a meaningful red flag.

Bluetooth — Increasingly used for location tracking in environments where GPS is unavailable (think retail stores and indoor spaces). A game or productivity app with no device-pairing features has no obvious reason to need Bluetooth.

What the Data Actually Shows

Researchers at Carnegie Mellon's CyLab Privacy and Security lab conducted a landmark study tracking what data Android apps actually transmitted versus what their permission requests implied. The findings were striking: a substantial portion of apps with location permissions sent location data to third parties even when users weren't actively using the app. Several apps with microphone permissions were found to be capturing audio snippets under conditions that didn't match their stated use case.

Apple's App Privacy Report feature, introduced in iOS 15, lets users see in real time which apps are accessing which data and how often. Users who've explored it often come away surprised — not necessarily because apps are doing something clearly illegal, but because the frequency and context of data access doesn't match their intuitive model of how the app works.

What You Can Actually Do About It

You have more control than you probably realize, and exercising it doesn't require technical expertise.

Review permissions before you install. Both the App Store and Google Play show you what permissions an app requests on its listing page. Make it a habit to check before you download.

Audit existing apps. On iOS, go to Settings > Privacy & Security to see a full breakdown of which apps have access to what — and revoke anything that doesn't make sense. Android's Permission Manager (under Settings > Privacy) does the same.

Use "Ask Next Time" liberally. iOS lets you grant one-time permission for location and other sensitive data. Use it. If the app genuinely needs ongoing access, it'll ask again and you can evaluate it in context.

Be especially cautious with free utility apps. Free flashlight apps, free VPNs, free PDF scanners — these categories have historically been among the most aggressive permission requesters because their business models often depend on data collection rather than user payments.

Check Apple's App Privacy Report. Enable it under Settings > Privacy & Security > App Privacy Report. Leave it running for a week. What you see might change how you think about some of your most-used apps.

The permission system was designed to give users meaningful control over their data. But it only works if users are informed enough to use it. That starts with understanding that "Allow" isn't a neutral tap — it's a decision with real consequences for your privacy, your data, and potentially your wallet.