How do permissions work in Android?

Question

Accepted Answer

Android **permissions** control an app's access to sensitive resources and data (camera, location, contacts, storage). Apps must **declare** permissions and, for dangerous ones, **request them at runtime** — protecting user privacy and security.

## Why permissions exist

```text
Apps need user PERMISSION to access sensitive resources/data:
  → protects PRIVACY and security — apps can't silently access your camera, location,
    contacts, microphone, etc.
  → the user decides whether to grant access
```

## Declaring and requesting permissions

```text
1. DECLARE in AndroidManifest.xml (all permissions the app may use):
   <uses-permission android:name="android.permission.CAMERA" />

2. NORMAL permissions (low-risk, e.g. internet) → granted automatically at install
3. DANGEROUS permissions (camera, location, contacts, etc.) → must be REQUESTED at
   RUNTIME (the user sees a dialog and grants/denies)
```

```kotlin
// request a dangerous permission at runtime
if (ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA)
    != PackageManager.PERMISSION_GRANTED) {
  requestPermissions(arrayOf(Manifest.permission.CAMERA), REQUEST_CODE)
}
// handle the user's response in onRequestPermissionsResult / the result callback
```

## Best practices

```text
✓ Request permissions WHEN NEEDED (in context), with explanation — not all upfront
✓ Handle DENIAL gracefully (the user can deny; degrade the feature, don't crash)
✓ Request only what you NEED (minimal permissions → user trust, privacy)
✓ Modern Android: finer-grained permissions, one-time grants, "while using the app"
  location, and increasing user control
```

## Why it matters

Understanding how permissions work is important because **accessing sensitive resources requires permissions**, and handling them correctly is essential for both functionality and respecting user privacy, so it's must-know Android knowledge.

Permissions exist to **protect user privacy and security** — apps can't silently access sensitive resources (camera, location, contacts, microphone, storage), and the user decides whether to grant access.

Understanding the model is necessary: apps must **declare** permissions in the manifest, with **normal (low-risk) permissions granted automatically** but **dangerous permissions** (camera, location, contacts) requiring **runtime requests** where the user is prompted to grant or deny.

Understanding how to **request permissions at runtime** (checking if granted, requesting if not, and handling the user's response) is essential practical knowledge for any app using sensitive features — without proper permission handling, features fail or apps crash.

Understanding the **best practices** is particularly important: requesting permissions **when needed in context with explanation** (not all upfront, which users distrust), **handling denial gracefully** (users can deny, so the app must degrade gracefully rather than crash — a common bug if not handled), and requesting **only what's needed** (minimal permissions build user trust and respect privacy).

Understanding that modern Android has **increasingly fine-grained, user-controlled permissions** (one-time grants, while-using-the-app location) reflects the evolving privacy landscape.

Since accessing sensitive resources requires permissions and handling them correctly (declaring, requesting at runtime, handling denial gracefully, and requesting minimally) is essential for both functionality and respecting user privacy, and since this is a common need in apps using device features, understanding how permissions work in Android is essential, practically-important knowledge — necessary for building apps that access sensitive resources correctly while respecting the privacy and user-control that permissions protect, a fundamental aspect of responsible Android development.