Why do apps ask for so many permissions?
For a mixture of genuine functional need, defensive over-requesting, and data collection — and the three are difficult to distinguish from the request alone.
Legitimate reasons:
The feature requires it. A camera app needs the camera; a maps app needs location.
Optional features requested up front rather than when used, which is poor practice but common.
Platform coarseness. Some permissions are broader than the need. Historically, an app wanting to save one photo needed access to the entire photo library — which is why both major platforms introduced scoped access, letting you grant individual files rather than everything.
Less legitimate reasons:
Advertising and analytics SDKs. Third-party code bundled into the app frequently requests permissions for its own data collection, not for the app's features. Developers often do not fully audit what their dependencies request.
Data as a product. Location history in particular has substantial resale value, and location-broker markets have been the subject of repeated investigations.
Future-proofing, requesting permissions for features that do not yet exist.
Which permissions carry the most risk: location — especially background location, which is far more revealing than foreground; microphone and camera; contacts, which exposes other people who did not consent; SMS, which can intercept authentication codes; accessibility services, which are extremely powerful and a known malware vector; and "display over other apps".
What has improved. Both platforms now offer while-using-the-app rather than always; approximate rather than precise location; one-time permissions; automatic revocation for unused apps; and indicators showing when the camera or microphone is active.
Practical guidance: deny first and grant when a feature actually fails; prefer approximate location and while-using; review permissions periodically in settings; and treat an app requesting permissions unrelated to its function as a reason to choose a different app.