The everyday permissions
These are requested by huge numbers of legitimate apps. Their risk is about which app holds them and whether it needs them — not the permission itself.
- Location — comes in two strengths. Precise location is your exact spot; approximate is roughly your neighborhood. The bigger question is when: “while using the app” is very different from background location, which lets an app follow your movements even when you’re not using it. A weather app wanting background precise location deserves a second look; a maps app wanting it while in use is normal.
- Camera and Microphone — necessary for cameras, calls, voice notes. Worth questioning when an app has no obvious reason to listen or see. On modern iPhones and Android, an indicator dot appears when the mic or camera is active.
- Contacts — lets an app upload your address book. Convenient for messaging apps; also a common way your social graph gets fed to advertisers and data brokers.
- Photos, Files, SMS, Call logs — access to your content. Grant narrowly. On modern phones you can often share selected photos instead of your whole library.
Accessibility services — the powerful one
Accessibility exists so screen readers and assistive tools can help people with disabilities. To do that job, it can read everything on your screen and act as if it were you — see text in any app, capture what you type, and tap buttons automatically.
That is enormous power, and stalkerware wants it precisely because it bypasses the protection of individual apps: an app with accessibility can read your messages inside an encrypted messenger, because it reads the screen after the app has decrypted them. Very few apps legitimately need it — genuine accessibility tools, some password managers, some automation apps. If an app you don’t recognize (or a “system update”-sounding app) holds accessibility access, that is worth investigating. Check under Settings → Accessibility on Android.
Notification access
This lets an app read every notification you receive — including message previews from other apps. A monitoring app with notification access can capture incoming texts and chat messages without opening those apps at all. Legitimate uses exist (smartwatch companions, some automation), but like accessibility, it’s a permission worth accounting for. Android lists holders under Settings → Notifications → Device & app notifications (wording varies by phone).
Device administrator
Device admin was designed for workplace management — letting an IT department enforce a passcode or remotely wipe a lost work phone. Stalkerware misuses it for a simpler reason: an app with device-admin rights is harder to uninstall, and can sometimes lock or wipe the phone. If you find a device-admin app you didn’t set up (and you’re not on a managed work phone), treat it seriously — but revoke it only after reading Safety first, because on a monitored phone that action can be noticed.
Other capabilities worth knowing
- Display over other apps — can draw on top of other apps; used legitimately by chat-head and overlay tools, abused to hide activity or fake screens.
- Usage access — reveals which apps you open and for how long; a detailed behavior log.
- Install unknown apps (sideloading) — allows installing apps from outside the official store. Necessary for a few legitimate tools, but it’s also how most Android stalkerware arrives. If it’s enabled and you didn’t enable it, ask why.
- Always-on VPN — routes all your traffic through one app. Real VPNs use this; a monitoring app can use it to watch or reroute your network activity.
How to review your permissions
- Android: Settings → Privacy → Permission manager shows every permission and which apps hold it. The Privacy dashboard shows recent access. Check Accessibility and Special app access separately — the powerful permissions live there, not in the normal list.
- iPhone: Settings → Privacy & Security lists each capability and the apps granted it. iOS 16+ Safety Check reviews sharing in one place.
- Both: revoke what doesn’t fit the app’s purpose. If something powerful looks wrong and you suspect monitoring, read Safety first before changing it.