Why does a flashlight app want camera permission? It does not need it
The short answer
It does not need it. Since Android 6.0, apps can switch the flash LED on with CameraManager.setTorchMode, which does not open the camera and needs no camera permission. A torch app that still asks for the camera is using the old route, or wants the camera for something else.
You install a torch app, and the first thing it does is ask to use your camera. It is a fair thing to wonder about. A light does not need to see anything.
The short answer is that it does not need the camera. Android has had a direct way to switch on the flash LED for years, and that way asks for nothing.
Two ways to reach the same LED
The flash LED on the back of your phone belongs to the camera hardware. For a long time the only way an app could switch it on was to open the camera, set its flash to “torch” mode, and keep the camera session running. Opening the camera needs the camera permission, so every torch app asked for it.
Android 6.0 (Marshmallow, API 23) added a second route: CameraManager.setTorchMode. It switches the LED on or off without opening a camera session at all. Google’s documentation for it lists no permission requirement, unlike opening the camera.
Android 13 went one step further with turnOnTorchWithStrengthLevel, which sets the brightness on phones whose flash supports levels. That also needs no permission. There is more on that in how to change your phone torch brightness.
So on any phone made in the last several years, a torch app has a choice. One route needs your camera; the other needs nothing.
Why some apps still ask
There are a few honest reasons and a few less honest ones.
- Old code. An app first written before 2015 may never have moved to the new API. It still opens the camera because that is how it was built.
- A second feature. Some torch apps also offer a magnifier, a mirror or a QR scanner. Those really do need the camera. If you only want a light, you are granting access for features you will not use.
- Data. Some free utility apps have been caught collecting far more than they need. A torch app with camera, location and contacts permissions is asking for things that have nothing to do with light.
How to check a torch app before you install it
You can find most of this out in a minute.
- Read the Play listing. Scroll to “About this app” and look for what it says about permissions. Then open “Data safety”, which lists what the developer says the app collects and shares.
- Look for labels. Play marks apps that “Contain ads” and have “In-app purchases” under the app name. Neither is bad, but both should match what the description says.
- After installing, check the permissions. Long-press the app icon, tap App info, then Permissions. Android lists what is allowed and what is not.
- Notice the prompt. If the app asks for the camera the first time you tap the light, you know which route it uses.
What about internet access?
Internet access is a normal permission. Android grants it at install without a prompt, and it does not appear in the Permissions screen as something you can switch off. Every app that shows ads has it, because the ad has to come from somewhere.
That makes the useful question not “does it have internet” but “what does it send, and to whom”. A good privacy policy names the ad network, says what the ad library reads, and tells you how to opt out.
How Kelvin does it
Kelvin, our flashlight and women safety app for Android, uses setTorchMode, so the torch asks for no runtime permissions at all. Android never shows a prompt for the light. It reads the torch state back from Android rather than keeping its own copy, so the app and the Quick Settings tile always agree.
To be exact about the rest: the free version shows one banner ad from Google AdMob at the top of the light screen, and Google’s ad library brings the normal internet access with it. The ad never appears on the full-screen light, and it does not load until three seconds after you open the app. Pro, a one-time purchase, stops the ad library from starting at all, so the app makes no network calls. Every mode of light works offline either way.
The one permission Kelvin can ask for is location, and only if you switch on Send my location for its Safety SOS. It is read only while an SOS is active, to put a map link into the message you send yourself. Kelvin has no SMS, call, contacts or camera permission: it opens your own SMS app with the message ready, and you press Send.
The app’s Permissions screen, under Settings, explains this and opens Android’s own settings page for Kelvin, so you can check it rather than take our word for it. The privacy policy says the same thing in full.
If you mostly reach for a torch in an emergency, read how to send SOS with your phone flashlight next.
- Flashlight
- Privacy
