Permission rationale provided before request prompts
Why it matters
Users who see an unexpected system permission dialog — with no context about why an app needs access — deny at significantly higher rates than users who receive an explanation first. iOS only allows one native permission request per permission type: if the user denies the cold prompt, the app can never ask again via the system dialog. GDPR Art. 7 requires consent to be freely given, informed, and specific; a system dialog with no preceding rationale does not satisfy the informed requirement. Google Play's permission UX guidelines similarly require that the app explain the purpose before the native prompt fires. A denied permission that could have been granted represents a permanently lost capability — the user must manually navigate to Settings to re-enable it.
Severity rationale
High because a denied permission from a cold, unexplained prompt is permanent on iOS and permanently degrades the feature — the only recovery requires the user to find and change a system-level setting.
Remediation
Display an in-app explanation modal before every sensitive permission request. Keep the rationale specific to the feature the user is about to use.
import { Alert } from 'react-native'
import { request, PERMISSIONS, RESULTS } from 'react-native-permissions'
async function requestMicrophoneWithRationale() {
await new Promise<void>(resolve =>
Alert.alert(
'Microphone Access',
'Voice messages require microphone access. We never record without your action.',
[{ text: 'Continue', onPress: resolve }]
)
)
const result = await request(PERMISSIONS.IOS.MICROPHONE)
return result === RESULTS.GRANTED
}
The rationale must reference the specific feature ("voice messages"), not vague purpose ("improve your experience"). For Android, set rationale directly in the request() call options — the library surfaces it via Android's built-in rationale dialog.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Permissions & Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 7 — Conditions for consent
- external · google-play-permission-ux — Google Play: Permission best practices — explain why you need it
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-permissions-privacy·automated