Cybersecurity Foundations (Grades 6–8) · lesson 13 of 48 · 12 min
The Hidden Cost of Free Apps
You download a free game. You tap “Allow” on a few permission requests without reading them. The game works great. But in the background, it is recording your precise location every 15 minutes, reading your contacts list, and sending all of it to an advertising network that sells it to data brokers.
This is not hypothetical. It is the standard business model for a significant portion of the app economy. When an app is free, the product being sold is often you — your data, your behaviour, your location, your relationships.
Understanding app permissions is not about being paranoid. It is about making informed decisions. Some data collection is a reasonable trade-off for a useful free service. But you should understand what you are trading, and you should have the tools to limit collection to what is actually necessary.
The scale of app data collection
A 2022 study found that the average Android app requests 6 permissions. 45% of apps request access to location. 25% request access to contacts. Many apps share data with 5 or more third-party advertising and analytics companies. Some popular apps have been found to record audio in the background, track location even when “off”, and read clipboard contents — all without users knowing.
Understanding App Permissions — What Each One Means
When an app requests a permission, it is asking for access to a specific capability or data source on your device. Here is what each major permission actually gives an app access to.
The key question for any permission is: does this app need this to do what it claims to do? A flashlight app needs the camera flash — not your location, contacts, or microphone. A game needs storage to save progress — not your call logs or SMS messages. When an app requests permissions that have no obvious connection to its function, that is a red flag.
Activity 1 — Permission Red Flag Sorter
Legitimate or Red Flag?
- A maps app requesting location access
- legit
A maps app genuinely needs your location to show where you are and give directions.
- A flashlight app requesting access to your contacts
- redflag
A flashlight only needs the camera flash. Contacts access has no legitimate purpose for a flashlight.
- A video calling app requesting microphone and camera access
- legit
Video calls require both microphone and camera — these permissions are necessary for the app’s core function.
- A simple calculator app requesting location access
- redflag
A calculator performs arithmetic — it has no need for your location. This suggests data collection for advertising.
- A messaging app requesting contacts access
- legit
Messaging apps need contacts to let you find and message people you know.
- A puzzle game requesting microphone access
- redflag
A puzzle game has no need for your microphone. This is a red flag for background audio recording.
- A photo editing app requesting storage access
- legit
Photo editors need to read and save image files — storage access is necessary.
- A weather app requesting access to your call logs
- redflag
Weather data requires location — not your call history. This is data collection with no legitimate purpose.
The Principle of Least Privilege — Applied to Apps
The principle of least privilege is a foundational security concept: any user, program, or system should have only the minimum access needed to perform its function — nothing more.
Applied to apps, this means: grant only the permissions the app genuinely needs. Deny everything else. If an app stops working without a permission that seems unnecessary, that tells you something important about what the app is actually doing.
How to review permissions
iPhone/iPad: Settings → Privacy & Security → [Permission type] — see which apps have access and change it. Or: Settings → [App name] — see all permissions for that specific app.
Android: Settings → Apps → [App name] → Permissions. Or: Settings → Privacy → Permission Manager.
Do this audit now. You will likely find apps with permissions they should not have.
Activity 2 — Permission Decision Scenarios
App Permission Decisions
Activity 3 — Match the Permission to the Risk
Permission Risk Matching
Activity 4 — Flashcard Review
App Permissions and Data Collection — Key Terms
App Permission A request by an app for access to a specific device capability or data source — camera, location, contacts, microphone, storage, etc. You control whether to grant or deny each permission.
- Core
- Principle of Least Privilege
A security principle: grant only the minimum access needed for a function to work. Applied to apps: deny all permissions that are not necessary for the app’s core purpose.
- Principle
- Location (Always) vs. (While Using)
“Always” allows background location tracking 24/7. “While using” only allows access when the app is open. For most apps, “while using” is sufficient and far less invasive.
- Setting
- Contacts Permission
Grants access to every name, phone number, and email address in your address book — not just your own information, but everyone you know. Only grant to apps that genuinely need it (messaging apps).
- Permission
- Permission Red Flag
A permission request that has no obvious connection to the app’s stated function. Example: a flashlight requesting contacts, a calculator requesting location. Suggests data collection rather than functionality.
- Concept
- Privacy Policy
A document explaining what data an app collects, how it is used, and whether it is shared with third parties. Often long and complex — look for sections on “data sharing” and “third parties”.
- Document
- “If it’s free, you’re the product”
A saying that captures the business model of many free apps: the app makes money by collecting and selling user data to advertisers and data brokers. Understanding this helps you make informed decisions about which apps to use. Concept
Activity 5 — Permission Audit Challenge
Review these app permission requests and decide whether each is justified or suspicious. Apply the principle of least privilege.
Justified or Suspicious Permission?
- Navigation app requesting location access
- justified
A navigation app cannot function without knowing your location. This permission is essential for the app’s core purpose.
- Calculator app requesting contacts access
- suspicious
A calculator has no reason to access your contacts. This suggests data harvesting rather than functionality.
- Video calling app requesting camera and microphone
- justified
Video calls require camera and microphone access. These permissions are essential for the app’s stated purpose.
- Flashlight app requesting location (always on)
- suspicious
A flashlight only needs to control the camera flash. Always-on location access has no connection to this function.
- Messaging app requesting contacts access
- justified
A messaging app needs contacts to help you find people to message. This is a reasonable permission for this type of app.
- Wallpaper app requesting microphone access
- suspicious
A wallpaper app has no reason to access your microphone. This is a significant red flag for data collection.
- Photo editing app requesting photo library access
- justified
A photo editor needs to access your photos to edit them. This permission is necessary for the app’s core function.
- Weather app requesting contacts access
- suspicious
Weather apps need location, not contacts. Requesting contacts suggests the app is harvesting your address book for marketing or data broker purposes.
Final Quiz — App Permissions
App Permissions Knowledge Check
A free game app requests access to your contacts, location, camera, and microphone. The game has no social or communication features. What does this suggest?
- The app needs these permissions to run properly
- The app is likely collecting and selling your data — these permissions have no connection to a game’s core function
- All apps request these permissions by default
- The permissions are only used if you choose to enable those features
Answer: The app is likely collecting and selling your data — these permissions have no connection to a game’s core function
Permissions unrelated to an app’s stated function are a strong indicator of data harvesting. Free apps often monetise through data collection. Apply the principle of least privilege — deny permissions that are not necessary for the app’s core purpose.
What is the safest location permission setting for most apps?
- “Always” — so the app always has the most current location
- “While using” — so the app can only access location when you are actively using it
- “Never” — no app should have location access
- Location permissions do not affect privacy
Answer: “While using” — so the app can only access location when you are actively using it
“Always” allows background location tracking 24/7, even when you are not using the app. This creates a detailed record of everywhere you go. “While using” provides the functionality you need (navigation, local search) without constant background surveillance.
Previous lesson: Managing your online presence
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: IP addresses explained