> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.pixalate.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server. # Android app permissions and IVT risk > Pixalate's methodology for assessing the invalid traffic (IVT) risk of Android app permissions. Typical vs. atypical permissions, category-level and app-level scoring, caveats, and the permissions flagged as high IVT risk by default. Android apps must declare the permissions they need. Some permissions are more common in apps with high invalid traffic (IVT). Pixalate scores each permission an Android app requests for how likely it is to be used to generate IVT, and combines those scores into an overall **IVT permission risk** for the app. You see the result in the Media Ratings Terminal (MRT) on a Google Play app's Insight page, in the **App Permission Risk** section and in Pixalate Advisories. In the Enrichment API, it's the [`appPermissions`](/apis/enrichment-api-mobile-fields#apppermissions) widget and `riskOverview.overallIvtPermissionRisk`. ## What app permissions are An app permission controls an app's access to a system or device function through the operating system. Permissions often have privacy implications, such as access to precise location. They protect: * **restricted data**, such as system state and a user's contact information * **restricted actions**, such as connecting to a paired device or recording audio An Android app that needs sensitive data or functions must list the permissions it needs in its manifest file. Google classifies each permission by protection level and privacy risk. See Android's [permissions overview](https://developer.android.com/guide/topics/permissions/overview) and [list of permissions](https://developer.android.com/reference/android/Manifest.permission). Developers can also define custom permissions that aren't in Google's list. Pixalate's assessment doesn't cover them. ## Typical and atypical permissions Apps need some permissions to work. A navigation app needs precise location to give directions; a drawing app doesn't. So permissions can be **typical** or **atypical** for an app, depending on whether the app needs them for what it's meant to do. The app's category is a good proxy: the most common permissions are usually present in every app in the category. Atypical permissions give an app more access than it needs, which makes them an avenue for generating IVT or other malicious activity. ## How Pixalate assesses permissions Pixalate looks for permissions that correlate with higher IVT than the average for the app's category. For example, among navigation apps, a location permission doesn't make higher-than-usual IVT more likely, because every navigation app uses it. Among games, the same permission may be associated with higher IVT, so it can be flagged as high risk there. This lets Pixalate ask of each app: * Does the app need this permission to function? * Does this permission indicate behavior that increases IVT? * Overall, does the app request many unnecessary permissions? > **Note** > > The assessment measures **correlation, not causation**. A high-risk permission makes it more likely that the app generates high IVT. It doesn't mean that permission causes the IVT by itself: IVT can be generated in more complex ways, such as by combining several permissions. ## Methodology ### Phase 1: score each permission within a category 1. Classify every app as high or low risk based on its IVT levels. 2. Calculate the share of high-risk apps in each category. 3. Calculate how many high-risk apps in the category have a given permission. 4. Compare how often apps with that permission are high risk with how often apps in the whole category are high risk. 5. If the share for the permission is higher than the share for the whole category, give the permission a risk score for that category, in proportion to the ratio between the two. ### Phase 2: score each app An app can request several risky permissions, so Pixalate calculates an overall IVT permission score for the app: 1. Count how many high- and medium-risk permissions apps in the category normally have, and how many the app has. 2. Compare the app's ratio with the category's, and rate the app **high**, **medium** or **low** depending on the size of the difference. ### Caveats * If a category has fewer than 10 apps, Pixalate uses the permission's high-risk app ratio across all categories instead. * Pixalate also rates each permission high, medium or low overall, compared with other permissions. * A permission that appears in fewer than 10 apps isn't scored, and defaults to low. * Some permissions are always flagged as high IVT risk, based on historical IVT data. They're listed below. ## Permissions flagged as high IVT risk by default The protection level is Google's classification of the permission. Protection levels can change between Android versions, so check Android's [list of permissions](https://developer.android.com/reference/android/Manifest.permission) for the current level. | Permission | Description | Android protection level | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------- | | `ACCESS_BACKGROUND_LOCATION` | Allows an app to access location in the background. | Dangerous | | `WRITE_EXTERNAL_STORAGE` | Allows an app to write to external storage. | Dangerous | | `WAKE_LOCK` | Allows using PowerManager wake locks to keep the processor from sleeping or the screen from dimming. | Normal | | `RECEIVE_BOOT_COMPLETED` | Allows an app to receive the `ACTION_BOOT_COMPLETED` intent that's broadcast after the system finishes booting. | Normal | | `REQUEST_COMPANION_RUN_IN_BACKGROUND` | Allows a companion app to run in the background. | Normal | | `REQUEST_COMPANION_USE_DATA_IN_BACKGROUND` | Allows a companion app to use data in the background. | Normal | | `DISABLE_KEYGUARD` | Allows an app to disable the keyguard if it isn't secure. | Normal | | `SYSTEM_ALERT_WINDOW` | Allows an app to create windows of type `TYPE_APPLICATION_OVERLAY`, shown on top of all other apps. | Signature | | `UNINSTALL_SHORTCUT` | Allows an app to uninstall a shortcut to the app. | Not for use by third-party apps | | `GET_ACCOUNTS` | Allows access to the list of accounts in the Accounts Service. | Dangerous | | `READ_PHONE_STATE` | Allows read-only access to phone state, including the device's phone number, current cellular network information, the status of any ongoing calls and a list of any PhoneAccounts registered on the device. | Dangerous | | `WRITE_SYNC_SETTINGS` | Allows an app to write the sync settings. | Normal | | `REQUEST_DELETE_PACKAGES` | Allows an app to request deleting packages. | Normal | | `KILL_BACKGROUND_PROCESSES` | Allows an app to call `ActivityManager.killBackgroundProcesses(String)`. | Normal | | `WRITE_SETTINGS` | Allows an app to read or write the system settings. | Signature | | `REQUEST_INSTALL_PACKAGES` | Allows an app to request installing packages. | Signature | | `REBOOT` | Required to be able to reboot the device. | Not for use by third-party apps | | `READ_LOGS` | Allows an app to read the low-level system log files. | Not for use by third-party apps | | `DIAGNOSTIC` | Allows an app to read and write to diagnostic resources. | Not for use by third-party apps | | `FACTORY_TEST` | Run as a manufacturer test app, running as the root user. | Not for use by third-party apps | | `INSTALL_PACKAGES` | Allows an app to install packages. | Not for use by third-party apps | | `PACKAGE_USAGE_STATS` | Allows an app to collect component usage statistics. | Not for use by third-party apps | | `UPDATE_DEVICE_STATS` | Allows an app to update device statistics. | Not for use by third-party apps | | `WRITE_SECURE_SETTINGS` | Allows an app to read or write the secure system settings. | Not for use by third-party apps | | `MOUNT_FORMAT_FILESYSTEMS` | Allows formatting file systems for removable storage. | Not for use by third-party apps | | `ACCESS_CHECKIN_PROPERTIES` | Allows read and write access to the "properties" table in the checkin database, to change values that get uploaded. | Not for use by third-party apps | | `BROADCAST_PACKAGE_REMOVED` | Allows an app to broadcast a notification that an app package has been removed. | Not for use by third-party apps | | `INSTALL_LOCATION_PROVIDER` | Allows an app to install a location provider into the Location Manager. | Not for use by third-party apps | | `MOUNT_UNMOUNT_FILESYSTEMS` | Allows mounting and unmounting file systems for removable storage. | Not for use by third-party apps | ## Related #### [Enrichment API mobile fields](/apis/enrichment-api-mobile-fields#apppermissions) The `appPermissions` widget, field by field. #### [Glossary](/mrt/glossary) Definitions for every label and tooltip in the MRT. Questions? Email [support@pixalate.com](mailto:support@pixalate.com).