Camera, microphone, location, notifications and more all work through the same prompt system. Here is what each permission does and how to audit and revoke it.
On this page
The three states of a permission
A page you have never visited before asks to see your location. You are halfway through something else, so you tap Allow without reading the dialogue, and you carry on. Months later the same grant is still sitting there, and you have long since forgotten giving it.
A browser is a walled garden with a long list of doors, and permissions are the locks on each one. A website cannot simply switch on your camera or read your location; it has to ask, and you have to answer. That gatekeeping is genuinely effective, but only if you understand which doors exist, which of them open without a prompt, and how to close one after you have answered yes.
Every permission sits in one of three conditions, and the prompt you see is the request to move a permission from undecided to decided.
- Prompt. No choice has been made. The next time a site asks, the browser shows a dialogue and waits.
- Granted. The site may use the feature without asking again. This is the state that matters most, because it is silent and persistent.
- Denied. The site is blocked. Some sites re-prompt or explain, but the browser will not hand over access.
A granted permission is easy to forget. A site you allowed to see your location once may still hold that ability months later, long after you have stopped thinking about it. Auditing means reviewing the granted list, not just responding to new prompts.
The states side by side
The three states look very different in practice, and the differences are what make a grant so easy to lose track of. A prompt announces itself; the other two are silent, and only one of them lets the site in.
| State | What you see | Lasts after you close the tab | How to change it |
|---|---|---|---|
| Prompt | A dialogue | No | Answer it |
| Granted | Nothing | Yes, until revoked | Revoke it in site settings |
| Denied | Nothing | Yes, until reset | Reset it to prompt |
Only the first row asks for your attention; the other two simply sit there, which is why auditing means reviewing a list rather than trusting your memory of a dialogue.
The permission list
The full set has grown over the years as browsers exposed more device capabilities. Some are used for video calls, some for maps, some for things you may never have needed. The common ones, and what each hands over:
| Permission | What it grants |
|---|---|
| Camera and microphone | Live video and audio |
| Location | Your geographic position |
| Notifications | Messages outside the tab |
| Clipboard | Reading what you copied |
| Bluetooth and USB | Paired or connected devices |
| MIDI | Musical instrument devices |
| Screen capture | A tab, window or the whole screen |
| Persistent storage | Data not cleared automatically |
They are not equal in weight. Camera and microphone can put your face and voice into someone else’s hands, and location can place you in the physical world. A notification grant only lets a site interrupt you, and a clipboard grant only reads what you have already copied.
Use the permissions test to see the current state of each one in your browser, rather than guessing from memory.
What a page can read without asking
The prompts cover the powerful capabilities, but there is a category of information that needs no consent at all. A page can learn a great deal from what your browser reports as part of ordinary rendering and scripting.
- Device and browser details. Every request announces a user agent, and scripts can read screen size, language, time zone and platform.
- Hardware indicators. The number of CPU cores, the amount of memory, and the result of drawing operations are all available without a prompt.
- The list of your devices. This is the subtle one. The media devices interface can enumerate the kinds of camera and microphone you have — how many, and their general type — without triggering a permission dialogue. Only the actual stream requires consent. Check what your setup exposes with the media devices test.
That gap matters: a page that never needed permission to learn you have a particular webcam and headset may already have enough to help identify you.
Why the list keeps growing
Browsers keep adding permissions because the web keeps gaining capabilities. Each new feature — a new device class, a new storage model, a new way to interact — arrives with a lock that did not exist before. The prompt system is the same everywhere, so a permission you have never seen can appear on a site tomorrow.
This is why a memorised list of permissions is not much use: the list you learned last year is already out of date. The defence is not memorising it, but knowing where it lives and checking it now and then.
How to audit and revoke
The control panel is per-site and per-permission, and there are two places worth knowing.
In the address bar
In most browsers, click the padlock or the site icon in the address bar to see what that site currently holds, and change any entry from granted to denied or back to prompt. This is the view for the site in front of you.
In the browser’s settings
A global settings page lists every site you have ever answered for, which is the best place to catch forgotten grants. Going through it once, slowly, is the exercise most people skip.
Habits that keep grants in check
A few habits make the whole business manageable.
- Grant only when in use. Answer a prompt for a specific task rather than pre-emptively, so the grant is tied to a moment you remember.
- Prefer “this time” over “always”. A one-off grant expires when you leave, which limits the damage of a bad decision.
- Revoke after the fact. If you cannot remember why a site has your location, it should not have it.
- Remember what private mode changes. Actions taken in a private window are usually not remembered, which is a substitute for consent rather than a form of it.
Private mode is not consent
Private mode is not invisible, and it is not a substitute for answering a prompt carefully. Its limits are worth understanding, as covered in incognito mode and what it hides. Techniques also exist to guess whether you are using it, which the incognito detection test can demonstrate.
So treat a private window as a place where less is remembered, not as a place where a site sees less of your hardware.
Run these two checks
Review what you have already handed out. Open the permissions test to see the state of every permission, then run the media devices test to check whether your cameras and microphones are visible without any prompt at all. Revoke anything you cannot justify, and you will have closed more doors than any single setting could.