How to complain if an online platform forces unnecessary permissions?

Many online platforms and mobile apps often ask for a variety of permissions when users install or interact with them, such as access to contacts, location, camera, microphone, and even call logs. While some of these permissions may be necessary for the app’s basic functions, others are often unnecessary and go beyond what is required to provide the service. These platforms may pressure or coerce users into granting these permissions, even when it is not needed, violating the user’s privacy rights and data protection laws. If an app forces users to provide unnecessary permissions, it is important to understand how to complain and protect your rights.

Legal Protections for Consumers Regarding Unnecessary Permissions

General Data Protection Regulation (GDPR) – EU

Under the GDPR, apps must obtain explicit consent from users for each permission they request. The platform must also inform users about the purpose of each permission and how the data will be used. If an app forces unnecessary permissions or collects excessive data, it violates the GDPR's principles of data minimization and purpose limitation.

• Action: Consumers can report the app to the Data Protection Authority (DPA) in their country if the app is requesting excessive permissions.

California Consumer Privacy Act (CCPA) – USA

The CCPA gives consumers in California the right to know what data is being collected and to opt-out of unnecessary data collection practices. If an app forces users to grant permissions for unrelated or excessive data collection, consumers can file a complaint with the California Attorney General.

• Action: Consumers can ask the app to provide a clear explanation for the permissions it requires, and request that the app only collect the minimum data necessary for its operation.

Personal Data Protection Bill (PDPB) – India

In India, the Personal Data Protection Bill (PDPB), once enacted, will require apps to obtain informed consent for data collection and only request necessary permissions for providing their services. The bill will prohibit forced permissions and offer the right to users to manage their data.

• Action: If the PDPB is enacted, users can report apps that force unnecessary permissions to the Data Protection Authority (DPA).

Right to Consent and Data Minimization

Users have the right to control the data they share with apps, and the data collected must be proportionate to the app’s functionality. Apps that force unnecessary permissions violate this principle and must be reported.

• Action: Users can report such apps to the relevant regulatory body or file a complaint with the consumer protection authorities.

Steps to Take If an Online Platform Forces Unnecessary Permissions

Review the App’s Permissions

The first step is to review the permissions the app is requesting. Check whether the permissions are necessary for the app to function or if the app is asking for more than it needs (e.g., access to contacts or location when it's not required for the app’s core functionality).

• Action: If the app is asking for unnecessary permissions, such as access to camera or microphone when not needed, deny those permissions through the app’s settings.

Disable Unnecessary Permissions

Most devices allow you to manage app permissions. You can go to your phone’s settings and disable any permissions that you feel are unnecessary.

• Action: Go to your phone's App Settings, find the app in question, and turn off the permissions it does not need.

Contact the App’s Customer Support

Reach out to the app’s customer support or helpdesk and ask why they require certain permissions and whether these permissions are necessary for the app’s core functions. Request that they remove unnecessary permissions.

• Action: If the app's customer support doesn't respond adequately, escalate the issue to higher levels of support.

File a Complaint with Regulatory Authorities

If the app continues to force unnecessary permissions, or if it doesn’t provide a valid reason for needing those permissions, you can file a complaint with the relevant data protection authority. For example:

• GDPR: File a complaint with the Data Protection Authority (DPA) in the European Union if the app is based in an EU country.
• CCPA: In California, file a complaint with the California Attorney General.
• India: File a complaint with the Data Protection Authority under the PDPB once it becomes operational.

• Action: Provide evidence of the unnecessary permissions and explain how it violates privacy laws.

Report on Consumer Platforms

You can also report the app on consumer forums or review websites, where users share their experiences and concerns. Websites like Google Play Store or Apple App Store have reporting features that allow users to flag apps for inappropriate behavior.

• Action: Write a detailed review of your experience with the app and report the issue publicly to alert other users.

Seek Legal Action

If the app's actions result in significant harm (e.g., breach of privacy, identity theft, etc.), you may have the option to pursue legal action for damages caused by the violation of privacy rights.

• Action: Consult with a legal professional to understand your options for filing a lawsuit or pursuing compensation for any harm caused.

How to Protect Yourself from Apps Requesting Unnecessary Permissions

Read App Permissions Carefully

Always review the permissions requested by an app before installation. Ensure that the permissions requested align with the app’s functionality.

• Tip: Only grant the minimum permissions necessary for the app to work.

Install Apps from Trusted Sources

Download apps only from trusted sources like the Google Play Store or the Apple App Store, which have stricter guidelines and regulations regarding app behavior.

• Tip: Look for apps with high user ratings and positive reviews to ensure that they follow proper privacy standards.

Use Permission Management Tools

Some devices and security apps offer tools that allow you to monitor and control which apps have access to specific permissions.

• Tip: Use these tools to keep track of the permissions granted and restrict apps from accessing sensitive data unnecessarily.

Limit App Permissions Regularly

Periodically review and update the permissions you’ve granted to apps. This can help you remove permissions that may have been granted unknowingly or unnecessarily over time.

• Tip: Regularly go to your settings and review permissions for all apps.

Educate Yourself on Privacy Settings

Learn about the privacy settings on your device and apps, and familiarize yourself with how to manage app permissions. Understanding your rights can empower you to protect your privacy.

• Tip: Enable location services and other sensitive permissions only when absolutely necessary.

Example

Scenario

You download a photo-editing app that asks for access to your contacts, location, and microphone, even though it only needs access to your photo gallery to function.

Steps the consumer should take

• Review Permissions: Check the permissions requested by the app. If the app is asking for unnecessary permissions like access to contacts or microphone, deny those permissions.
• Contact Customer Support: Reach out to the app’s customer service and ask why it requires these permissions. Request them to clarify the necessity of each permission.
• File a Complaint with Regulatory Authorities: If the app continues to ask for unnecessary permissions, file a complaint with the relevant data protection authority in your region.
• Report on Review Platforms: Share your experience on the Google Play Store or Apple App Store, detailing your concerns about the unnecessary permissions.