Android App Security · Permissions in Depth · Lesson 2 of 5

Special Access

Powerful kinds of access that live in Settings, not in a pop-up.

Access without a pop-up

Some abilities are too powerful for a quick tap on Allow. Android calls them special permissions, or special app access. There's no pop-up for these. An app has to send you to a settings page, and you flip a switch there yourself. On Pixel and many other phones they're gathered in Settings > Apps > Special app access. Samsung and other makers sometimes put them under a menu on the Apps screen, so searching Settings for "special access" is the quickest route.

Here are some of the important ones.

• Display over other apps (developers know it as SYSTEM_ALERT_WINDOW) lets an app draw on top of whatever you're using. Chat bubbles and floating video players need it. An app with it could also cover another app's screen with a convincing fake.
• Usage access shows an app which apps you open, when, and for how long. That's useful for screen time tools, and it's a detailed diary of your day.
• All files access, added in Android 11 (the switch may read Allow access to manage all files), lets an app read and change every file in your phone's shared storage: downloads, documents, photos, and more. Google Play only allows it for apps that truly need it, such as file managers, backup apps and antivirus apps. Other apps' private folders stay off-limits.
• Install unknown apps, which you met in Mobile Fundamentals, lets a specific app, like a browser or chat app, install other apps.

A good rule: an app should need special access only for its main job. A file manager asking for all files access makes sense. A wallpaper app asking for usage access doesn't.

Notification access and device admin apps

Two more kinds of special access deserve a careful look.

Notification access lets an app read every notification that arrives, from every app, and dismiss them. Smartwatch companion apps and some automation tools use it. Think about what shows up in your notifications, though: message previews, emails, and the one-time codes your bank texts you. An app with this access could read a code and swipe the notification away before you ever saw it. On recent Pixel phones the setting lives under Special app access as Device & app notifications. Other phones may call it Notification access, often under Settings > Notifications.

Device admin apps are apps you've activated with the Device Administration feature. An active device admin can enforce screen lock rules, lock the phone immediately and even erase it, which is useful when a work phone is lost. There's a catch for removal. You can't uninstall a device admin app until you deactivate it as an admin first. Some older malware abused this to make itself hard to remove. Since Android 9, Google has been retiring parts of this feature in favor of newer work profile tools, but the list still exists on many phones. Look for Device admin apps under Special app access, or under Security settings on some phones.

Make reviewing these lists a habit, a few times a year. For each entry, ask whether you recognize the app and whether its job really needs that power. If not, turn the access off. Keep an eye out for an app you don't remember installing, or one whose name doesn't match what it's asking for.