Don’t tap “Allow all” just to use an app: the data isn’t mandatory, and refusing to share it won’t block service access

7. Don’t tap “Allow all” just to use an app: the data isn’t mandatory, and refusing to share it won’t block service access

Cost: No cost involved. The hard part is resisting the urge to tap “Allow all.”

In plain terms: Apps request your data. If that data isn’t strictly necessary to deliver the service, the app can’t deny you access just because you refuse to share it. It may only collect what it actually needs. For instance, a map app needs your location, but a flashlight app has no business asking for your contacts list.

Benefit: Two key legal points apply here. First, providers may not deny products or services on the grounds that a user hasn’t consented or has withdrawn consent — unless processing that data is genuinely essential to delivering the service. Second, data collection must stay limited to what’s absolutely required for the intended purpose; only the minimal amount needed may be gathered.

Evidence grade: A

Notes: The deciding factor is simple: is this data truly essential to providing the service? Location data is essential for a map app, but contact lists aren’t needed for a flashlight app. After installing an app, head to your phone’s settings under app permissions and turn off any nonessential permissions. Grant access only when you genuinely need them, and even then, limit it to a one-time permission.

Sources: National People's Congress Standing Committee (2021). Personal Information Protection Law. China National People's Congress. <http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html>: Article 6 "The collection of personal information should be limited to the minimum scope to achieve the purpose of processing, and no excessive collection of personal information"; Article 16 "Personal information processors shall not refuse to provide products or services on the grounds that individuals do not agree to the processing of their personal information or withdraw their consent; unless the processing of personal information is necessary to provide products or services"; Article 15 "Where personal information is processed based on individual consent, individuals have the right to withdraw their consent. Personal information processors should provide a convenient way to withdraw consent."