Question 1

If an app is on the Play Store, doesn't that mean its permissions have been approved as appropriate?

Accepted Answer

No - and this is the single most consequential misunderstanding about mobile app safety. Google's Play Store and Apple's App Store both run automated and human review on submissions, but that review screens for malware, policy violations, deceptive behavior, and obvious abuse patterns. It does not screen for whether the permissions an app requests are excessive for the app's stated purpose. A flashlight that asks for Contacts, Microphone, Location, and SMS will pass review as long as it discloses those permissions in its store listing and prompts at install time. Once the user accepts the install-time prompt, the app holds those permissions indefinitely until the user manually revokes them in Settings. The store's role is to keep outright malware and policy-violating apps out of the catalog. The role of vetting whether an app's scope makes sense for what it does falls to you, the user, at the moment you tap Install. That is why install-time permission prompts exist and why reading them carefully is the actual line of defense. "Approved by the Play Store" means "not detected as malware" - it does not mean "this app is not over-permissioned."

Question 2

What's the practical rule I can use in the moment to decide whether a permission request is reasonable?

Accepted Answer

The one-sentence rule: a requested permission is appropriate only if you can name the user-facing feature it powers in a single, specific sentence. "Camera so the app can read QR codes" passes - the feature is concrete, the connection is obvious, and the permission is necessary for the function. "Microphone for voice notes I record on each scan" passes if voice notes are an actual feature you intend to use. But "Microphone because the app might want to add voice features later" fails - speculative future features are not justification, and you can always re-grant the permission when that feature actually ships. The rule cuts through marketing language and makes you state the connection between the permission and a real user-facing feature you would actually use. If you cannot name the feature, or if the named feature is something you would never use, the answer is no. This works because it forces a specific, defensible reason. Vague justifications ("for personalization", "to improve your experience", "to enable smart features") never survive the rule. Specific ones ("for the QR scanner to point at QR codes") always do. Apply this at install time when the prompt appears, and apply it again during periodic permission audits in Settings - the same test that lets the permission in should keep it in.

Question 3

When I find an app with excessive permissions, should I revoke the permissions or uninstall the app entirely?

Accepted Answer

It depends on whether the app has actively abused those permissions and whether the app is genuinely useful with the legitimate subset. If the app is something you genuinely use, only the excess permissions are problematic, and there is no evidence the app has been actively using them, the right move is surgical revocation: take away the permissions that don't match the stated purpose and keep the app. A flashlight that asks for Contacts, Location, and Storage but works perfectly fine with just Camera is a candidate for revocation - keep the flashlight, lose the unrelated scope. If, however, system logs or security telemetry show the app has been actively using those excess permissions - making outbound network calls when you have not opened it, reading contacts you never asked it to access, recording microphone audio you never authorized - then permission revocation is not enough. Revocation stops future abuse but does not retrieve data that has already left the device. An app that has demonstrably abused permissions has lost the trust to keep any of them, and the safe move is full uninstall. The same logic applies to apps from publishers with confirmed history of abuse, even if the specific app on your device has not yet been observed misbehaving - you cannot prove a negative, and if the publisher is shipping over-permissioned apps as a pattern, the next update could activate the excess scope. When in doubt, uninstall - reinstalling later is cheap; recovering exfiltrated data is impossible.

Machtigingen voor mobiele apps

Wat is Machtigingen voor mobiele apps?

Wat je leert in Machtigingen voor mobiele apps

Machtigingen voor mobiele apps — Trainingsstappen

Een QR-scanner voor ledenoproepen

Op zoek naar een QR-scanner

Het beste resultaat kiezen

Tikken op Installeren

Machtigingen die een QR-scanner niet nodig heeft

Tikken op Toch installeren

Een rustige dinsdagochtend

Een e-mail van het SOC

Waarom heeft de Play Store dit niet opgemerkt?

Open het beveiligingsportaal