How ABA May Support Reviewing App Privacy and Permission Settings

Map the app and data

Record developer or provider, account owner, purpose, login route, people or organizations connected, stored content, sharing, payment, retention, and deletion options. Use the current official app and device settings rather than a generic screenshot.

Review each permission

Check contacts, camera, microphone, photos, files, location, Bluetooth, notifications, health data, accessibility services, background activity, tracking, and connected accounts. Ask whether each permission is needed now and what feature changes if it is removed.

Protect access while reducing exposure

Choose the narrowest usable audience and permission. Test that AAC, captions, screen readers, communication, safety, work, or health functions still operate. Record the setting, date, owner, and why it remains enabled.

Use authoritative safety framing

FTC's online safety page notes that some apps ask for contact, camera, storage, location, or microphone access they may not need. CISA's Secure Our World emphasizes strong passwords, MFA, phishing awareness, and updates. ASHA supports AAC access.

A practical example

Quinn reviews ten permissions for one app. Purpose and owner are clear for eight. Quinn keeps four, limits two, disables two, and holds two for the responsible administrator. Report unresolved permissions instead of treating them as approved.

Questions families can use

What does the app do? Who owns the account and device? Which permission enables which feature? Who receives the data? Can access be narrowed? What must be retested after a change?