12

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop doing stuff or making noise or the like.

However, it also provides an application with your IMEI, phone number, and remote number (number of inbound or outbound calls). This allows a lot of personal information collection, all under the guise of "my weather app needs to know when you're on the phone so it doesn't interfere with calls".

Why is knowing someone is on a call even a special permission? Certainly phone calls are still common enough to warrant providing a permission-free API that all apps can use to not bother a user in-call.

Why would Android hide such a powerful permission that allows detailed personal identification and cross-user tracking behind something that seems so innocuous? It only serves to get users in the habit of allowing permissions and accepting excuses from app developers.

Improve this question
1
  • Anyone knows if this has changed since 2014? Years ago iPhones allowed a developer to identify the actual phone, which was a stupid idea, because if you replaced a broken phone with a new one, it was obviously a different phone. This has fortunately changed since. And on an iPhone, you can detect the audio state, if the speakers or microphone are turned on. Without knowing the reason.
    – gnasher729
    Jun 25 at 13:37

1 Answer 1

Reset to default
1

One specific piece of data you can access with the "Phone State" permission is the IMEI/IMSI of your phone/sim card. This number is used to identify your device for target-ads (so the ad provider could tell whether you've already seen an ad). Since showing ads is a common business model in mobile apps, the "Phone State" permission being requested is as well very common. I think it's a logical decision (from an economic point of view) of Google to group this ability with other, somehow similar abilities so users won't be scared of permissions that could obviously harm their privacy. It's definitely possible to give the ability to detect whether the user is on call without a special permission, but that would go against Android's policy of requiring explicit permissions for everything that gets beyond the local concerns of an app.

Improve this answer
3
  • 2
    Right, that's the question. It'd be an intentional malicious move by Android/Google. Also, since there's next to no privacy impact in viewing phone is on/off, why would there be a permission for that?
    – MichaelGG
    Apr 3, 2014 at 20:40
  • @MichaelGG public static boolean isPhoneOn() {return true;} I know this isn't what you meant but I couldn't resist.
    – user253751
    Apr 3, 2014 at 22:33
  • @user253751 At the very least there should be a state whether the phone has just been turned on but isn't fully operational yet, whether it is in the process of shutting down, or whether it is in a low power mode with very limited functionality.
    – gnasher729
    Jun 25 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .