Privacy becomes tangible when an application asks a person to share a photo, location or another protected resource. For designers, the question is what the person needs to understand at that moment: why the access is relevant, what scope is necessary and what happens if they decline.
Why it matters: A well-written policy elsewhere cannot make an unexplained access request feel proportionate to the task.
Ask where the reason is visible
Apple’s Human Interface Guidelines recommend requesting permission in context and limiting access to what an application needs. A feature’s immediate purpose should explain the request better than a broad promise of a “better experience.”
Consider a hypothetical app that attaches a photo to a report. Asking when the person selects that feature creates a clear relationship between their action and the requested resource. Requesting unrelated access on the opening screen makes that relationship harder to see.
The platform’s exact APIs and permission behaviour determine the implementation. The design principle is to avoid asking the user to approve an unspecified future use.
Design the refusal too
A permission dialog has more than one outcome. The product should explain what remains possible after a refusal and what cannot work without the requested access.
That does not mean every feature can function without its required data. It means the limitation should be understandable, without pretending the whole application necessarily needs access that only one task requires.
Apple’s guidance also discusses system-provided ways to grant limited location access for a specific action. Such patterns are useful to study because they connect the scope of permission to the scope of the task.
Make the claim match the implementation
A short explanation is only helpful if it is accurate. A team should be able to connect the interface wording to the data actually requested, used and retained.
This is a product-design discussion, not a legal compliance checklist. Platform guidance does not by itself establish compliance with any particular privacy law.
The same questions apply when an assistant acts across applications. What Happens When Every App Has an Agent looks at permissions and scope when a system can perform actions rather than merely display information. In either case, trust depends on a request whose meaning is visible before the person accepts it.
Reporting & Sources
Interface-design analysis, reviewed September 26, 2026. Not legal advice.
