Betting app permissions: what location, camera, storage, SMS and contacts access allow

When a betting app wants access to part of your phone, Android shows a prompt and you choose. Android's own help pages say what each permission opens up, and Google Play adds stricter rules for the most sensitive ones, five of which this page covers: location, camera, storage, SMS and contacts. If the app came as an APK file rather than from Google Play, also read what Android warns you about when you install a betting APK.

How do Android permissions work?

Android's developer documentation sorts permissions into types. Install-time permissions are granted automatically when you install an app and cover access that barely touches your privacy. Runtime permissions, which Android also calls dangerous permissions, have to be requested while the app is running, and the system shows you a prompt first.

The documentation names location and contact information as examples of private user data. It calls the camera and microphone particularly sensitive.

The same page sets three goals: you control what you share, you understand what an app uses and why, and an app touches only the data needed for the task you start. It also tells developers that many tasks, taking photos among them, can be done without declaring any permission at all.

The five permissions and what they allow

The middle column gives the plain descriptions from Android's help page on app permissions. The right-hand column sets each one against what a licensed betting app has to do under Kenyan rules.

Location: the permission with a legal reason

Under regulation 82(1) of the Conduct of Gambling Operations Regulations, 2026, no one may gamble online until the licensee has checked who they are, verified where they are and assured their age. Regulation 41(c) adds that the online system must be able to shut out prohibited locations by geo-location. A licensed app that asks for your location is doing what those rules require.

Android offers two levels of detail. According to its developer documentation, approximate location is accurate to about 3 square kilometres and precise location is usually within about 50 metres. Android also separates foreground access, used while the app is on screen, from background access, which is meant for features that keep sharing your position, such as family location sharing.

In Settings, location can be set to All the time, Allow only while using the app, Ask every time or Don't allow. A check made when you sign in or place a bet is the kind of foreground use Android describes, so Allow only while using the app covers it. What operators check and what they may store is set out in why betting apps need your location in Kenya.

Camera, photos and files: what an identity check needs

Regulation 82(2) says verification must rely on reliable, independent and electronically verifiable data sources before the account is activated. Regulation 82(4) adds that it includes official identification documents. That is why an app may ask to photograph your document, a step explained in why a betting app asks for your ID photo.

Camera access fits that step, and Ask every time limits it to the moment you need it. Uploading a picture you already took does not require broad access to your gallery. Google Play's policy says apps targeting Android 13 or later may request READ_MEDIA_IMAGES only when system pickers such as the Android Photo Picker are not enough for the app's core functionality.

The Files permission, described as access to all files on your device, goes much further. Google Play restricts this All files access to apps that cannot use more privacy-friendly methods, and it says choosing individual files by hand is not a valid reason for it. An identity upload is one file you choose by hand.

SMS: why a betting app does not need your inbox

Android's help page says the SMS permission lets an app send and check your text messages. Your inbox holds sign-in codes, bank and mobile money messages and private conversations. Google Play lets an app hold SMS permissions only if it is your default SMS, phone or assistant app, or if Google approves it under a short list of reviewed exceptions.

Account verification via SMS is on Google's list of uses that will not be permitted. Google points developers to the SMS Retriever API, which reads a verification code without any extra app permission, and says users can also type the code by hand. Nothing in the identity or location rules of L.N. 112 requires an app to read your messages, and how a deposit request reaches your phone is explained in in-app M-PESA payments and the STK push.

Contacts: no part of KYC or payments

Android's help page describes the Contacts permission simply as access to your contacts. Google Play treats every contact as personal and sensitive data. Its policy page says apps targeting Android 17 or later may request READ_CONTACTS only if the Android Contact Picker is not enough for their core functionality, with compliance mandatory from 27 January 2027.

The checks in regulation 82 concern you, not the people in your phone book. Regulation 93(2) of L.N. 112 also limits a licensee to collecting and processing data only for purposes directly related to running the gambling operation. You can answer a contacts request with Don't allow, and none of the checks above depends on it.

How to check and change an app's permissions

Android's help page gives these steps for a single app:

1. Open the Settings app and tap Apps.
2. Tap the betting app. If it is not listed, tap See all apps first.
3. Tap Permissions to see what you allowed or denied.
4. Tap a permission and choose Allow or Don't allow. For location and camera you may also see Allow only while using the app and Ask every time.

To see every app holding one permission, open Settings, then Security and privacy, Privacy and Permission manager. In each app's page, Pause app activity if unused lets Android remove permissions from apps you stop opening.

Before you install from Google Play, the listing's Data safety section shows what the developer says the app collects and shares, and whether that collection is optional. Compare that summary with the prompts the app shows after install.

What a permission request can tell you about the app

Google Play enforces its rules on SMS, photos, files and contacts for apps distributed through Google Play. An APK shared in a chat group may never have been reviewed against them, so read its requests with more care. A request for SMS, contacts or all files on top of location and camera is one of the signs listed in fake betting apps in Kenya: the signs of a clone.

Regulation 93(1) requires that personal data collected during gambling operations be handled in line with the Data Protection Act. Regulation 93(3) bars a licensee from using it for any form of marketing without your prior consent.

This page does not cover microphone, notifications or nearby devices access, and it does not track changes between Android versions beyond those named above. iPhone permissions work differently and are not covered here.