Short answer: permissions on iOS live in three places, and the one worth your attention is the App Privacy Report, because it shows what apps actually accessed rather than what they are merely allowed to access. The catch is that it only records from the moment you switch it on — so the practical move is to enable it today, then audit what it shows after a couple of weeks.
This page is the audit. For what each permission option actually grants — the four location choices, limited photo access, whether Background App Refresh is a permission — see App Permissions Explained, which is the reference those decisions depend on. For which privacy settings change anything at all, see iPhone Privacy Settings: Which Ones Actually Change Anything.
The three places permissions live
| Where | What it shows | Best used for |
|---|---|---|
Settings → Privacy & Security | Every app that holds each permission, grouped by category | Auditing by category — the fastest sweep |
Settings → [app] | Every permission that app holds, in one place | Checking one app you already suspect |
Settings → Privacy & Security → App Privacy Report | What apps and websites actually accessed, and their network activity | Finding the gap between granted and used |
They answer different questions. The first two tell you what you have allowed; the third tells you what has been happening. An audit that only reads the permission lists will keep permissions an app stopped needing a year ago, because nothing there tells you whether the access is still being used.
App Privacy Report: the only view that shows actual access
Turn it on at Settings → Privacy & Security → App Privacy Report. From then on it collects:
- Data and sensor access by app — which apps touched the camera, microphone, location, photos, contacts and the rest, with the most recent uses listed.
- App network activity — which domains apps contacted, which is often more informative than the permission list, because an app that needs no permission at all can still be talking to a dozen servers.
- Website network activity — the same view for pages you visit in Safari.
Two properties make it worth enabling even if you do nothing else today:
- It only records from the moment it is switched on. There is no reconstruction of the past, so a report you enable after an incident shows nothing about the incident.
- It covers a rolling recent window, not all time. The screen states the period it covers, and that period is short. The report is a snapshot of recently observed behaviour rather than an archive, which is exactly why checking it is a routine rather than a one-off.
What the report cannot tell you
The report is more limited than its name suggests, and knowing the limits stops you drawing the wrong conclusion:
- It shows access events, not content. "Camera" tells you an app used the camera; it does not tell you what was captured, or whether anything left the phone.
- It shows domains, not payloads. You learn that an app contacted an analytics domain, not what was in the request. Domain names are still useful — an unfamiliar domain in an app that has no business calling out is a good reason to look closer.
- A permission being unused is not the same as a permission being unneeded. An app you open twice a year may legitimately show nothing in the window while still needing access the next time you open it.
- Absence of activity is not proof of privacy. An app can collect data through an SDK while you are using it in the foreground, which is access, not background collection.
Used properly it is a prioritisation tool: it tells you which of your forty apps deserve a look, so you spend the audit on those and leave the rest alone.
A ten-minute audit, in order
The order matters, and it is by value per unit of risk — starting with the permissions that change the most behaviour when revoked, and ending with the ones that need judgement:
- Location Services, at
Settings → Privacy & Security → Location Services. This is the highest-value sweep on the phone. For every app set to Always, ask whether its job genuinely continues with the screen off — navigation, delivery tracking, an activity recorder. If not, change it to While Using the App, which already stops location when you leave the app. Also turn off Precise Location for anything that only needs your neighbourhood: weather, local news, store finders. - Photos, same section. For any app that asked for full library access, consider Select Photos instead. It grants only what you pick, which is the right answer for the common case of sending or uploading an image. Keep full access only for tools that browse your library inside their own interface, such as a photo manager or a backup app.
- Tracking, at
Settings → Privacy & Security → Tracking. Decide once whether apps may ask to track you across other companies' apps and websites. If you leave it on, each request is a prompt you can decline individually; if you turn it off, apps cannot ask at all. - Microphone and Camera, same section. These lists are short, which is the point — read them and ask whether every app on them has a reason to be. A scanner or a note-taking app with the microphone is worth a second look.
- Local Network, same section. Apps that scan the local network appear here. This permission is easy to grant by reflex during setup and rarely reviewed afterwards.
- Switch on App Privacy Report if you have not already, and put a reminder in your calendar for two weeks' time. That is when the report starts being worth reading.
When you find something you do not like
Revoking is a normal, reversible action, and it is worth being precise about what happens:
- iOS asks the app again the next time it needs the access, so a denial is a decision for now, not a permanent ban. That makes experimenting cheap.
- Most apps degrade rather than break. A maps app without precise location is less accurate; a chat app without full photo access still sends the photos you select. The exceptions are apps whose whole function is the permission — a navigation app with location off is not a degraded navigation app, it is a non-functional one.
- The right test is the smallest one. Change one permission for one app, use the app normally for a day, and see whether you notice. If you do not, the permission was not doing anything you valued.
Keeping it honest over time
An audit is only useful as a habit, because permissions accumulate: a setting granted to make a dialog go away in an emergency is still there years later. Three cheap routines cover it:
- After installing an app, decide its permissions while you still know what it is for, rather than accepting the first-run prompts by reflex.
- Every few months, read one category in
Settings → Privacy & Security. Rotating through them is faster than a full sweep and catches the drift. - Read App Privacy Report when something feels off — a phone that is warm, a battery that drains, a domain you do not recognise. Network activity is often the fastest way to find out which app is responsible, and it pairs well with the per-app usage view described in Background App Battery Use.