Requesting permissions that grant access to sensitive device capabilities or personal data beyond what an application strictly needs exposes users to unnecessary privacy risks.
Some permissions grant access to device capabilities and personal data that have a significant impact on user privacy, such as precise location, camera, microphone, and file storage. When an application requests these permissions beyond what its functionality strictly requires, it collects or gains access to personal information unnecessarily.
Permissions classified as dangerous by Android must be requested at runtime and require explicit user consent. The Android permission system defines which permissions are dangerous,
including ACCESS_FINE_LOCATION, ACCESS_MEDIA_LOCATION, and others that grant access to sensitive user data.
When an application holds unnecessary permissions, it has access to personal data or device capabilities beyond what it needs to function. This excess access increases the risk of privacy violations: if the application behaves maliciously or is compromised, the additional permissions can be exploited to track users, capture sensitive media, or access private files.
In AndroidManifest.xml:
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" /> <!-- Noncompliant --> <uses-permission android:name="android.permission.ACCESS_MEDIA_LOCATION" /> <!-- Noncompliant -->
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />