There’s a permission on your Android phone that most people grant without a second thought. It’s requested by apps that seem entirely reasonable to trust — a smartwatch companion, a fitness tracker, a widget app that surfaces notifications on your lock screen, an app that lets you reply to messages from your desktop. The permission sounds mundane: notification access.
What it actually grants is the ability for those apps to read the full content of every notification that appears on your device. Every one.
That includes your banking alerts. Your OTPs — the one-time passwords sent by your bank, your email account, your password manager when you log in from a new device. Messages from your contacts. Alerts from your healthcare portal. The two-factor codes that protect your most sensitive accounts. An app with notification access can read all of it.
What Notification Access Actually Does
On Android, notification access is a privileged system permission — distinct from the more familiar permissions like camera, microphone, or location. It grants an app the ability to read the current set of active notifications, receive new notifications as they arrive, and in some cases dismiss or interact with notifications on behalf of the user.
This is different from the notification permissions introduced in Android 13, which govern whether an app can send notifications to you. Notification access goes in the other direction: it governs whether an app can read notifications that other apps send to you.
The legitimate use cases are real. Smartwatch apps need notification access to mirror alerts to your wrist. Automation apps use it to trigger workflows when specific notifications appear. Notification aggregator apps read notifications to display them in a unified view. Parental control tools use it to monitor what apps children are receiving messages from.
Each of these is a genuine feature that requires genuine notification access to work. But the permission is binary: you either grant it or you don’t. There’s no “let this app read fitness notifications but not banking alerts” option. Notification access is all-or-nothing.
What an App Can Read with This Permission
An app with notification access can read:
Message content. SMS messages, messaging app notifications, and chat alerts show their message content in the notification payload. An app with notification access can read the full text of messages as they arrive.
One-time passwords. SMS-based OTPs — the six-digit codes sent by banks, email providers, and apps when you log in from a new device — arrive as SMS notifications. An app with notification access can intercept these codes before you’ve seen them.
Banking and financial alerts. Transaction notifications, balance alerts, fraud warnings, and payment confirmations are standard banking app notifications. The transaction amount, last four digits of your card, and vendor are commonly included in the notification text.
Healthcare alerts. Medical portals send appointment reminders, lab results, prescription refills, and messages from providers as notifications. These are among the most sensitive categories of personal information most people receive.
App-specific PINs and verification codes. Many apps send verification codes through app notifications rather than SMS, especially for account recovery flows. These arrive in the same notification stream.
Location context. Some notifications include location information — delivery arrival alerts, ride-sharing status updates, location-sharing app alerts.
The point isn’t that every app with notification access is harvesting this data. Most aren’t. But the capability exists. And the user’s mental model of “I gave that fitness app permission to mirror notifications to my watch” often doesn’t extend to “that means the fitness app’s code can read my bank OTP before I do.”
Why This Creates an Attack Surface
Malware and spyware that exploit notification access don’t need to inject code into your banking app or your SMS client. They only need notification access, which users grant voluntarily.
An attacker who can get notification access on a device gains a passive read capability on the most sensitive communications that device receives — without ever touching the apps that generate those communications. Two-factor authentication stops being much of a barrier if the second factor is readable by any app you’ve granted notification access to.
The attack path for sophisticated malware isn’t typically “request notification access.” It’s more subtle: a legitimate-seeming utility app requests notification access for a stated purpose, gains approval, and then uses that access for purposes beyond what the user understood. The permission request looks the same whether the app’s intentions are benign or malicious.
Notification access is also relevant in stalkerware contexts. Apps designed to monitor a device without the user’s knowledge exploit notification access to read incoming messages and OTPs. Unlike screen recording or location access, notification access is less well-known and therefore less likely to be checked when someone suspects their phone is being monitored.
What This Looks Like in Practice
A concrete scenario: you installed a third-party keyboard app several years ago that requested notification access for a smart reply feature. You’ve since switched keyboards, but the old app is still installed, still has notification access, and still receives every notification that comes to your phone — including the OTPs you use to log into your bank account and email.
Or: a smart home app you use to control lights requested notification access for a feature that lets you trigger automations from notifications. The feature works fine. You’ve never revisited the permission. The app can still read every alert that arrives on your device.
These aren’t hypothetical scenarios designed to alarm. They’re the ordinary accumulation of permissions across the lifecycle of a phone. Most people have granted notification access to several apps. Most people haven’t reviewed those grants recently. The permission landscape on a phone that’s two or three years old is rarely tidy.
How to Audit Notification Access on Android
Finding which apps have notification access on Android:
Go to Settings → Apps & notifications (or Notifications) → Special app access → Notification access.
The path varies slightly by Android version and manufacturer skin, but searching for “notification access” in your device settings should surface it. The resulting screen shows a list of apps with this permission currently enabled.
Walk through the list critically:
- Is this app still installed and still being used? An app you’ve stopped using has no legitimate ongoing need for notification access.
- Does the feature this app uses actually require notification access? A flashlight app has no legitimate reason to read notifications. A weather widget doesn’t need notification access.
- When did you last review this app’s privacy practices? Apps update their terms and change ownership. An app you vetted two years ago may have changed significantly.
Disable notification access for any app that you don’t actively use for a feature that genuinely requires it. The smartwatch app that mirrors your notifications needs it. The widget app you downloaded once to test and never deleted doesn’t.
iOS Notification Privacy
iOS handles this differently from Android. On iOS, apps cannot read the content of other apps’ notifications by default. iOS maintains stricter sandboxing that prevents the general notification-read capability that Android’s notification access permission enables.
The relevant iOS consideration is notification content in the lock screen. Notifications that display full message previews on a locked screen can be read by anyone who can see the screen. Settings under Settings → Notifications → Show Previews control whether notifications show content on the lock screen when the device is locked. The options are Always, When Unlocked, and Never. Setting sensitive apps (banking, messaging, healthcare) to “When Unlocked” prevents the notification content from being visible on the lock screen while still alerting you that a notification arrived.
For Messages specifically, settings under the individual app in Notifications allow you to turn off previews without affecting the notification alert itself.
The Permission You Grant Once and Forget
The specific hazard of notification access — and of over-broad app permissions generally — is that it’s granted once and then forgotten. Unlike a location permission that may prompt you again as the app’s behavior changes, notification access sits quietly in the background. The app continues receiving your notifications whether you’re thinking about it or not.
This is the normal lifecycle of most permissions on most phones. You grant them during setup, during onboarding of a new app, or when a feature requests access. You don’t revisit them systematically. Over the years, a collection of permissions accumulates that reflects a series of individual decisions that no longer accurately represent your intentions.
A quarterly permission audit — fifteen minutes reviewing which apps have location, microphone, notification access, and other sensitive permissions — is the maintenance task that most people know they should do and most people don’t get around to. The gap between “I should do that” and “I actually do it” is where risk accumulates.
Keeping What’s Sensitive Off the Notification Stream
Beyond auditing which apps have notification access, a separate layer of protection is managing what sensitive content flows through notifications in the first place.
For two-factor authentication: hardware security keys and authenticator apps that generate codes locally (rather than delivering them via SMS) route the second factor through a channel that notification-access apps can’t read. An authenticator app generates a time-based code on the device itself; it doesn’t arrive as a notification that can be intercepted. Moving away from SMS-based OTPs for your most sensitive accounts — banking, email, password manager — significantly reduces the value of notification access to any app that shouldn’t have it.
For private files and documents: the content of what you store in a personal storage account doesn’t flow through the notification layer. A notification might tell you that a file synced or that storage is running low, but the content of your files isn’t in that notification payload. Keeping sensitive personal files in an encrypted personal storage account — rather than in messaging apps or email threads where they’d arrive as notifications — separates the sensitivity of the content from the notification exposure risk.
One Audit, Genuine Protection
The practical upshot of all of this is narrow: spend fifteen minutes on your phone today reviewing notification access, revoke it from apps that don’t need it, and move to authenticator apps for your most sensitive accounts.
That’s not a heavy lift. And the protection it provides — removing the ability of arbitrary apps to passively read your OTPs, banking alerts, and private messages — is meaningful.
Most privacy recommendations require ongoing discipline. This one is mostly a one-time audit, plus the habit of checking notification access when you install a new app that requests it. A small change that removes a category of risk you probably didn’t know you were carrying.