App privacy access settings
Any app that can integrate with features that affect user privacy needs user approval. The first time an app wants to make use of a device’s hardware, like a camera or microphone, or use information from another app, the user receives a request with an explanation. The request notification may include a link to the needed setting in Privacy & Security. For example, a social networking app may request access to the camera or photos, or a database app may request access to a local network to connect to a server. After the user grants or denies access, they can change access later.
A device management service administrator can manage many app privacy access settings. Settings that affect user privacy, like access to the camera and microphone, can’t be turned on—but can be turned off—by a device management service. A user needs to turn on access for settings that affect privacy.
Unless managed by a device management service, iPhone, iPad, and Mac users can manage all privacy access settings in Privacy & Security. Some privacy access settings on Mac require administrator privileges to change.
The following are privacy access settings in iOS, iPadOS, and macOS. You can view apps that have requested access, and what access has been granted, in Privacy & Security for each of the following:
Hardware
Option | Description | Device management | Availability | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Accessibility | Allow apps to run scripts and system commands to control their Mac. The listed apps have requested access. To add an app, click the Add button (+), select the app in the list, then click Open. | Device management can configure specific Accessibility settings. | iPad, iPhone: Mac: | ||||||||
Accessories | If the user has a Mac laptop with Apple silicon, they have to approve Thunderbolt or USB devices and SD cards they connect to their Mac.
See the Apple Support article Allow USB and other accessories to connect to your Mac. | Device management can allow devices to always connect to specific accessories while locked. On a Mac, this allows new specific accessories to connect without authorization. | iPad, iPhone: Mac: | ||||||||
App Management | Allow apps to update or delete other apps on a user’s Mac. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Automation | Allow apps to access and control other apps on a user’s Mac. The listed apps have requested access. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Bluetooth | Allow apps to use Bluetooth on a user’s Mac. The listed apps have requested access. To add an app, click the Add button (+), select the app in the list, then click Open. | Device management can prevent the user from modifying Bluetooth settings. | iPad, iPhone: Mac: | ||||||||
Camera | Allow apps to access the camera on a user’s Mac. The listed apps have requested access. | Device management can deny specified apps access to the camera. | iPad, iPhone: Mac: | ||||||||
Critical Messages | List of allowed apps that have requested permission to send critical messages as text messages. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Developer Tools | Allow apps to run software that doesn’t meet the macOS security policy. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Input Monitoring | Allow apps to monitor input from the user’s mouse or trackpad, and to see what they type on the keyboard. The listed apps have requested access. To add an app, click the Add button (+), select the app in the list, then click Open. | Device management can set which approved apps have specified access to input devices (mouse, keyboard, trackpad). | iPad, iPhone: Mac: | ||||||||
Location Services | Allow apps, system services, and websites to gather and use information based on the current location of the user’s Mac to provide a variety of location-based services. To see specific system services that use their location, click the Details button at the bottom of the list. To allow the location of their Mac to be used by Siri Suggestions and Safari Suggestions, turn on Location-Based Suggestions. | Device management can restrict Siri Suggestions for apps, people, locations, and more during search. | iPad, iPhone: Mac: | ||||||||
Local Network | Allow apps to find and communicate with devices on the user’s local network. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Microphone | Allow apps to access the microphone on their Mac. The listed apps have requested access. | Device management can deny specified apps access to the microphone. | iPad, iPhone: Mac: | ||||||||
Motion & Fitness | Allow apps to access the user’s motion and fitness activity on their Mac. The listed apps have requested access. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Remote Desktop | Allow apps to access the user’s screen and audio through the Remote Desktop app. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Screen & System Audio Recording | Allow apps to record the user’s screen and audio, or just their audio. The listed apps have access. To add an app, click the Add button (+) below a list, select the app, then click Open. | Device management can deny specified apps access to capture (read) the contents of the system display. | iPad, iPhone: Mac: | ||||||||
Speech Recognition | Allow apps to access speech recognition on a user’s Mac. The listed apps have requested access. | Device management can allow specified apps to use the system Speech Recognition feature and to send speech data to Apple. | iPad, iPhone: Mac: | ||||||||
Software
Option | Description | Device management | Availability | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Calendars | Allow apps to access the user’s calendars. The listed apps have requested access. | Device management can allow specified apps access to event information managed by Calendar. | iPad, iPhone: Mac: | ||||||||
Contacts | Allow apps to access the user’s contacts. The listed apps have requested access. | Device management can allow specified apps to access contact information managed by Contacts. | iPad, iPhone: Mac: | ||||||||
Files & Folders | Allow apps to access files and folders in different locations. The listed apps have requested access. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Focus | Allow apps to see and share the user’s Focus status. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Full Disk Access | Allow apps to access all files on a user’s Mac, including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac. To add an app, click the Add button (+), select the app in the list, then click Open. | Device management can specify which apps can access files. | iPad, iPhone: Mac: | ||||||||
Health | Allow apps to access the user’s health data. The listed apps have requested access. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Home Accessories | Allow apps to access the user’s home data on their Mac. The listed apps have requested access. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Media & Apple Music | Allow apps to access Apple Music, the user’s music and video activity, and their media library on their Mac. The listed apps have requested access. | Device management can allow specified apps access to Apple Music, music and video activity, and the media library. | iPad, iPhone: Mac: | ||||||||
Passkeys Access for Web Browsers | Allow third-party browsers to use the user’s saved passkeys to sign them in to websites. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Photos | Allow apps to access the user’s photos. The listed apps have requested access. Note: If users have items that are stored outside the Photos Library, other apps may still have access to them. | Device management can allow specified apps access to images managed by the Photos app in:
Note: If the user puts their photo library somewhere else, it won’t be protected from apps. | iPad, iPhone: Mac: | ||||||||
Reminders | Allow apps to access the user’s reminders. The listed apps have requested access. | Device management can allow specified apps access to information managed by Reminders. | iPad, iPhone: Mac: | ||||||||
Wallet | Allow apps to access Apple Wallet. The listed apps have requested access. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Security
Option | Description | Device management | Availability | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Allow apps from | Protect a user’s Mac from malware by only allowing apps that come from the App Store or from identified developers.
| Device management can restrict app downloads on a Mac to one of the choices listed in the description. | iPad, iPhone: Mac: | ||||||||
FileVault | Require a login password to access the user’s startup disk. When they turn on encryption, all users are required to use a login password. Turning on FileVault creates a recovery key. If the user forgets their login password, they can use the recovery key to reset it. They can also add other users who are allowed to unlock and access the information on their Mac. See Manage FileVault. | Device management can force FileVault to be turned on. | iPad, iPhone: Mac: | ||||||||
Lockdown Mode | Limit apps, websites, and features if the user believes they’re being personally targeted by a highly sophisticated cyberattack. Most people are never targeted by attacks of this nature. See the Apple Support article About Lockdown Mode. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
Other
Option | Description | Device management | Availability | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Analytics & Improvements | Automatically send analytics information to Apple and app developers, which helps them serve customers better and improve the quality of their products.
For more information, see Share analytics information from your Mac with Apple and Siri settings on Mac in the Mac User Guide. | Device management can restrict sharing this data with Apple and developers. | iPad, iPhone: Mac: | ||||||||
Apple Advertising | Users may sometimes receive ads in Apple News, Stocks, and the Mac App Store that are targeted to their interests. To understand why a specific ad was shown, users can click the Ad button on the ad. Users can turn off Personalized Ads to prevent Apple from using their information for ad targeting. This may not decrease the number of ads they receive, but the ads may be less relevant to them. To prevent Personalized Ads, choose Apple menu > System Settings, click Privacy & Security in the sidebar, click Apple Advertising, then turn off Personalized Ads. Note: The option to turn off Personalized Ads appears after Apple News or Stocks asks for permission to send the user personalized ads. To review the Apple Advertising and Privacy policy, click About Apple Advertising & Privacy. | Device management can prevent users’ data from being used by the Apple advertising platform to deliver personalized ads. | iPad, iPhone: Mac: | ||||||||
Apple Intelligence Report | Generate a report of requests their Mac has sent to Private Cloud Compute in the last 15 minutes or 7 days. See Create an Apple Intelligence Report in the Mac User Guide. Note: Apple Intelligence isn’t available in all languages or regions. To check whether Apple Intelligence is available for the user’s device, language, and region, see the Apple Support article How to get the next generation of Apple Intelligence. | Device management can prevent these reports. | iPad, iPhone: Mac: | ||||||||
Sensitive Content Warning | Helps the user avoid seeing photos and videos that may contain sensitive content. Sensitive photos and videos appear blurred. The user can choose to view them without blurring. | Device management can’t restrict the use of this feature. | iPad, iPhone: Mac: | ||||||||
The first time an app wants to use information from another app, the user receives a request with an explanation. For example, a messaging app may request access to their contacts to find friends who are using the same app. After the user grants or denies access, they can change that access later.
Review or change access to information in apps on iPhone or iPad
Go to Settings > Privacy & Security.
Tap a category of information, such as Calendars, Reminders, or Motion & Fitness.
A list appears showing the apps that requested access. The user can turn access on or off for any app on the list.
Review or change access to information in apps on Mac
Choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
Select a category of information, such as Calendars, Reminders, or Motion & Fitness.
A list appears showing the apps that requested access. The user can turn access on or off for any app on the list.
Troubleshoot app privacy access issues
If an app can’t use hardware or information it needs, you can check and adjust its privacy access settings. Steps differ depending on whether your device is managed or unmanaged by an organization.
On unmanaged devices
Check Privacy & Security settings:
On iPhone or iPad: Go to Settings > Privacy & Security, then tap the option, such as Camera, Contacts, or Local Network. Make sure the app is turned on.
On Mac: Choose Apple menu > System Settings, click Privacy & Security in the sidebar, then select the option. Verify the app has permission.
Confirm app request behavior:
Delete and reinstall the app if you didn’t see a prompt the first time. The request appears again when the app next tries to use the feature.
Check administrator privileges (Mac only):
Some privacy settings, such as Camera or Microphone, apply to all users and require administrator privileges to change. Log in with an administrator account to adjust them.
Review system updates:
Make sure the device has the latest version of iOS, iPadOS, or macOS installed, since privacy frameworks are sometimes updated.
On managed devices
Check with your organization:
A device management service may turn off certain privacy settings, such as Camera or Microphone. If the setting is turned off by management, you can’t turn it on yourself.
Confirm managed restrictions:
If a switch for the setting doesn’t appear, or the setting’s behavior isn’t as indicated, it’s likely enforced by the device management service.
Review configuration profiles:
Some profiles control access to specific features. Removing a required profile may not be allowed, and attempting to do so can put the device out of compliance.
Escalate for adjustments:
Contact your device management service administrator if you need access to a feature that’s currently prevented by a policy. Only a device management service administrator can change those settings.
Troubleshoot app privacy access on iPhone and iPad with Reset Location & Privacy
You can use iOS or iPadOS to reset the Transparency, Consent, and Control (TCC) system on an iPhone or iPad.
Resetting app privacy access settings can be useful if an app doesn’t prompt for access as expected, or if settings appear stuck or missing.
Go to Settings > General > Transfer or Reset (iPhone or iPad), tap Reset, then tap Reset Location & Privacy.
This action resets app privacy access for all apps. When your location and privacy settings are reset, apps will stop using your Location Services information until you grant them permission.
Troubleshoot app privacy access on Mac with tccutil
You can use a macOS command-line utility, tccutil, to reset app privacy access settings managed by the Transparency, Consent, and Control (TCC) system.
Resetting app privacy access settings can be useful if an app doesn’t prompt for access as expected, or if settings appear stuck or missing.
The tccutil command doesn’t reset app privacy settings made using a device management service.
When to use tccutil
You can use tccutil to resolve the following conditions:
An app isn’t prompting for app privacy access when it should.
An app privacy access setting is unavailable in Privacy & Security and the setting isn’t managed.
An app privacy setting appears stuck, corrupted, or out of sync with changes made by the user.
You’ve removed or changed configuration profiles and app privacy settings don’t update.
How to use tccutil
When tccutil is used to modify app privacy settings for an app, the app is identified in the command using its bundle ID, or bundle identifier. You can use codesign to determine the bundle identifier for an app.
In Terminal, type
codesign -d -r - /Applications/_AppName_.app, then press Return to determine the bundle identifier for a specific app.
For more information on bundle IDs, see Bundle IDs for iPhone and iPad Apple apps in Apple Platform Deployment.
Task | Command | Effect |
|---|---|---|
Reset a single category for all apps (such as Microphone) |
| Clears all existing app privacy settings for that category; apps will ask again the next time they need to use the microphone. |
Reset a single category for a specific app |
| Resets app privacy settings for only the specified app in the chosen setting. |
Reset all permissions for all apps |
| Resets all app privacy settings across all settings and apps. |
Reset all permissions for a specific app |
| Resets all app privacy settings for the specified app across every category. |
Troubleshooting steps
Verify the app’s bundle identifier.
Restart the app or the Mac.
Check for management restrictions. On managed devices, if an app privacy access setting is allowed or denied by policy, management may not be reflected in the interface, and only a device management service administrator can change it.
Managed and unmanaged devices
On a managed Mac, you can only reset privacy access settings that haven’t been configured using a device management service.
On an unmanaged Mac, you can set or reset privacy access settings as needed.