Understanding Android’s One-Time Permissions and Their Privacy Implications

You know that moment when you carefully set an app's permissions to "Ask every time"? When you go into Settings, find that app, and make sure it only gets access to your microphone or camera when you explicitly allow it? You feel good about it. You're in control, right?

Yeah, about that.

I've been testing Android's one-time permission system, particularly with apps like WhatsApp. I set the microphone permission to "Ask every time" because I wanted tight control over when the app could listen. But what I discovered was something that doesn't quite match what Android's documentation promises.

Guess what? There's a gap. A small one, but it matters.

Wait, How Does This Work?

Here's the thing most people don't know: when you close an app after granting one-time permission, Android doesn't always revoke it instantly.

Think about it. You finish a WhatsApp call, swipe the app away from your recent apps, and assume that's it - permission gone. According to Android's documentation, that should be exactly what happens. Close the app, lose the permission.

But in reality, there's a window of about 30-60 seconds where the app can still access that permission without asking you again. It just... keeps using it. Like you never closed it at all.

The Google Documentation Says Otherwise

Yes. Completely.

Android's own documentation is crystal clear about this. Here's how one-time permissions are supposed to work:

While the app is visible and in use: It can access the requested resource.

If sent to background: It may still access the resource briefly.

If completely closed: The permission is revoked immediately.

That last part is key. "Immediately." Not "in about a minute." Not "after a short delay." Immediately.

But that's not what actually happens.

How I Found This

I started simple. Set WhatsApp's microphone permission to "Ask every time." This is a common setting for anyone who wants control over app access to sensitive features.

First call (Person A): When Person A called me via WhatsApp, I was prompted to grant microphone access. I selected one-time access, took the call, everything worked as expected.

Closing the app: After the call ended, I completely closed WhatsApp from the recent apps list. No background activity. According to Android's documentation, this should have removed the granted permission immediately.

Second call (Person B): About 30-60 seconds later, Person B called me. This is where things got strange - WhatsApp started the call without asking for microphone access again. It simply reused the previous permission silently, even though the app had been fully terminated.

This Isn't Just WhatsApp

Although my test was with WhatsApp (a Meta app), this isn't unique to it. Any Android app that requests runtime permissions for camera, microphone, files, or media can be affected. This means it potentially impacts apps from Meta, Google, Microsoft, and many other developers.

If Android itself doesn't enforce the re-prompt immediately after app closure, every app benefits from this short-lived permission reuse. It's a system-level behavior, not an app-specific exploit.

Try It Yourself

If you want to test this, here's exactly what I did:

1. Install and open any app that requests camera or microphone permissions
2. Set the permission to "Ask every time" in your Android settings
3. Trigger a feature in the app that needs this permission and grant it for one-time use
4. End the session and fully close the app (swipe away from recent apps or force stop it)
5. Within 30-40 seconds to 1 minute, trigger the same feature again

You'll likely see that the app gets access without showing the permission prompt. If you wait longer than about a minute, the permission prompt will reappear as expected.

Consistent and repeatable.

Why This Actually Matters

One-time permissions exist to give users control. When you select "Ask every time," you're explicitly saying you want to approve each use of that sensitive resource. The expectation is clear: every time means every time.

But this timing gap creates a disconnect between what users believe is happening and what's actually happening. During that 30-60 second window after closing an app, it can still access your microphone or camera without notifying you. For someone who chose "Ask every time" specifically to avoid silent access, this behavior runs counter to their intent.

It's worth understanding that this appears to be how Android handles the cleanup of one-time permissions at a system level, rather than something individual apps are doing deliberately. The delay might exist for technical reasons - perhaps to handle edge cases or improve user experience in certain scenarios. But regardless of why it exists, users who rely on "Ask every time" for privacy control should know it's there.

Final Thoughts

This article is written simply to help people better understand how app permissions work in practice, particularly with Android's one-time permission system. Many users reasonably assume that closing an app immediately revokes its one-time permissions, but that isn't always how things function behind the scenes. By sharing this, my goal is only to increase awareness so users can make more informed decisions about the permissions they grant and understand the actual behavior of the "Ask every time" setting. Understanding these details allows people to use their devices with clearer expectations and greater confidence.