Why Your Phone’s Physical Activity Permission Reveals More Than Steps

The setting is a neighbourhood café on an ordinary Tuesday morning.

A man scrolls through his notifications, looking mildly irritated, then looks up at his colleague. “Why does this weather app know where I was last night?” She shrugs, laughs and goes back to her latte. The exchange dies away, as though there is no real answer to the question.

At the back of the café, a young woman has just installed a new game on her phone. A pop-up appears: “Allow access to your activity?” Without reading it, she taps “Allow”, already absorbed by the first level. Her phone vibrates, her world carries on and life goes on.

Between sips of coffee, thousands of tiny, silent “OKs” are granted worldwide every minute. Behind each one may sit a level of access that hardly anyone truly monitors.

The permission hardly anyone reads, yet almost everyone grants

Location, the microphone and the camera get plenty of attention. Yet on both Android and iOS, the most overlooked permission may be the one concerning a phone’s “motion” or “physical activity”. Depending on the device, it is labelled “Physical activity”, “Motion & Fitness” or “Body sensors”. On paper, it exists to count steps or record exercise sessions. In practice, it can reveal far more than the distance you travel.

This permission can tell apps whether you are walking, driving or sitting on the sofa. It may infer when you leave for work, when you return home, and whether you use the stairs or the lift. It can do so without switching on GPS, the microphone or the camera. The information comes from the handset’s internal sensors: tiny instruments that record everyday movement, rotation and vibration.

Officially, the process is regulated. Operating systems frame this permission around “health”, “wellbeing” and “fitness tracking”. In settings, its icon is often a friendly-looking little walking figure. But behind that discreet symbol is a continuous stream of information about how you live. To someone able to interpret it, that stream is far from insignificant.

From “just steps” to a complete behavioural profile

One evening, Léa downloads a sleep-tracking app recommended by an influencer. She approves everything: activity, sensors and notifications. For the first few days, she is delighted. The app tells her when she has slept badly, when she woke up and when she ought to go to bed. Then one detail makes her pause: after a week, it suggests that she “reduce the time spent driving after 6 pm” to sleep better.

She never told the app that she drove. Yet it has worked it out. The acceleration, braking and minute vibrations of a phone inside a vehicle can be enough to identify that she is behind the wheel. Better still, the software has mapped a pattern: several late-night journeys, always at roughly the same time. She sees only an innocuous notification. Behind the scenes, however, part of her private routine has just been modelled.

Digital security researchers have demonstrated this repeatedly: motion sensors can reveal whether you are running, cycling, travelling by train or bus, or spending hours slumped in a chair. A Stanford University study even showed that analysing accelerometer data alone could estimate, with surprising accuracy, both your working hours and your overall activity level.

The stakes extend beyond sport. Insurers, advertisers, employers and sometimes even landlords may be interested in this kind of information. A model that notices you often drive at night, sleep little and move infrequently might classify you as a “risk profile”. No questionnaire is needed; all it takes is the “physical activity” permission you granted to a meditation app or a weather app claiming to be “a little more accurate”. The line between a useful service and behavioural profiling is remarkably permeable.

Taking back control of the quiet “physical activity” setting

The good news is that this permission is manageable. Realistically, that does not necessarily mean studying every pop-up in detail. Nobody wants every app installation to become an exam in digital law. The useful habit is to visit your settings once and take charge of this “motion / physical activity” option. On Android, it may be found under “Privacy” or “Body sensors”. On iPhone, it is called “Motion & Fitness” within “Privacy & Security”.

The easiest approach is to reverse the usual habit. Disable it for everyone, then enable it one app at a time only where an app genuinely needs to know that you are moving. A health app prescribed by a doctor? Fair enough. A reputable pedometer that is transparent about how it uses data? Possibly. But a puzzle game or torch app requesting access to your activity? That is where the problem begins.

We have all clicked “Accept” simply to dismiss an intrusive window. The action has become automatic, almost Pavlovian. Yet spending 10 minutes clearing out these permissions can materially change what your phone discloses about you. This tidy-up will not erase information already collected. It does, however, turn off the tap going forward. It is rather like closing a door that had been left slightly open “just to see”.

Common traps, quiet regrets and a little plain speaking

The apps most likely to misuse this permission are not always the ones you would expect. Some weather apps use activity data to predict “your ideal time to go out”. Ride-sharing services assess your movements to fine-tune notifications. Certain mobile games use these sensors to adjust how often you see adverts according to the time you spend on public transport. Every time, the same reassuring claim appears: “We use this data to improve your experience”.

Let us be honest: no one genuinely reads privacy policies from beginning to end. Not you, not me, and not even most developers themselves. That is precisely the issue. This understandable laziness has become the fuel for an entire industry built on monetising behavioural data. We end up sharing our comings and goings, our sleepless nights and the first signs of burnout because we only wanted to try a fashionable app promising a “better self”.

“It is not the data itself that is dangerous; it is the combination of many small pieces of data over time,” summarised a cybersecurity expert interviewed at a recent technology show in London. “One app sees your movements, another your payments, another your messages… and suddenly, an entire life can be reconstructed from crumbs.”

To avoid slipping into paranoia while retaining some control, a few simple guidelines can help sort the worthwhile requests from the rest:

• Deny activity access to any app unrelated to health, sport or transport.
• Check at least once every three months which apps hold this permission.
• Choose apps that offer a “local mode” or “no data sharing with third parties” option.
• Be cautious of free apps providing “premium” features without advertising or a subscription.
• Delete apps you have not used for several months, particularly those with access to motion sensors.

The quiet power of saying “no” - or at least asking “why?”

There is a subtle sense of relief in disabling these permissions. The phone suddenly feels a little less inquisitive, a little less attached to your body. On the surface, nothing changes: notifications still arrive, photos can still be taken and messages remain readable. In the background, though, a low-level noise falls silent. The ongoing conversation between your sensors and unknown servers stops, or at least slows down.

There is no miracle handbook at the end of this story. Everyone has their own tolerance for sharing data. Some people will happily let a sports app track every step in pursuit of a better time. Others may prefer to return to a plain paper notebook. The real question is not “share or do not share”, but “with whom, why, and for how long?”. A permission is not an everlasting contract. It is approval that can be withdrawn, granted again or negotiated.

There is something deeply collective about this individual choice as well. The less casually we hand over this data, the less attractive business models based on exploiting it become. A developer who finds that 80% of users deny activity access will think twice before making it an essential condition. Conversely, a silent mass of “yes” responses encourages the most intrusive practices, even where no harmful intention existed initially.

In a few years, we may look back on these permissions with the same amused embarrassment we feel about our old Facebook posts from 2009. We may wonder why we allowed a Sudoku game to know when we got into a car, or why a recipe app tracked our movements between the bedroom and the living room. Until then, one straightforward action remains within reach: open settings, find “physical activity” or “motion”, and ask of each app: “Is this really necessary?”. Very often, the answer is only one word.

Key point	Detail	Why it matters to the reader
The “physical activity” permission goes far beyond step counts	It can be used to infer your routines, journeys and schedules	It highlights the true scale of the tracking involved
It can be disabled and controlled	Privacy settings allow management on an app-by-app basis	It provides a quick, practical way to limit data collection
Saying no has a collective effect	Less available data makes these practices less profitable	It gives greater weight to every individual choice

FAQ:

• Which phone permission is actually tracking my movement? On most phones, it is called “Physical activity”, “Body sensors” or “Motion & Fitness”. It enables apps to read movement information from built-in sensors.
• Can apps really know if I’m driving without GPS on? Yes. By examining acceleration patterns, vibrations and rotation, many apps can infer whether you are in a car, on a bike, on a train or walking.
• How do I turn this permission off on Android? Go to Settings > Privacy (or Security & privacy) > Permission manager > Physical activity / Body sensors, then set apps to “Deny” apart from the few you genuinely trust.
• And how do I manage it on iPhone? Open Settings > Privacy & Security > Motion & Fitness. You can disable “Fitness Tracking” for all apps, then re-enable it only for apps selected carefully.
• Will my fitness or health app still work if I block it? Some functions may no longer work, including automatic step counting or detailed activity charts. Try the app with the permission disabled; if it stops working, you can decide whether the trade-off is worth your data.