Why does a flashlight app want camera permission?
Because it is the easy way, not because it is necessary. The short answer: since Android 6, an app can switch the LED with a single call that requires no permission at all. Any flashlight app asking for camera access in 2026 is either built on very old code or is doing something beyond making light.
The two ways to turn on an LED
The old way was to open a camera session and set its flash mode. That works, but opening a camera requires the camera permission — and the permission is not scoped to "flash only". It is the same permission that lets an app read the sensor.
The modern way is CameraManager.setTorchMode(), added in Android 6 (2015). It switches the torch directly. It does not open a camera session, it cannot capture a frame, and it requires no permission entry in the manifest and no runtime prompt. Android 13 added a companion call to set the torch strength in steps, also without a permission.
So a flashlight app has had a permission-free path for ten years. The ones still asking are usually old code nobody rewrote, a cross-platform wrapper that only implements the old path, or an app whose business is data rather than light.
Why people are suspicious, and why they are not wrong
Flashlight apps have a genuinely bad history. There is a well-known enforcement case in which a free flashlight app was found to be collecting and sharing location data with advertisers while presenting itself as a simple utility. That is why "is this flashlight app a virus?" is one of the most common questions in the category, and why review sections in several languages are full of warnings about spying through the camera.
The technical reality is narrower than the panic but points the same way: granting camera permission to an app that does not need it enlarges what a bad update could do later. A flashlight is the one category where the permission is entirely avoidable, which makes asking for it a meaningful signal.
Check what your flashlight app holds
- Open Settings → Apps and pick the flashlight app.
- Tap Permissions. A well-built flashlight app shows either nothing or only Notifications.
- Back on the app's page, look at the Play listing's Data safety section. An app that collects location or device identifiers should say so there.
- If it holds camera permission, you can revoke it and see what happens. If the light still works, the app never needed it.
What about internet permission?
Internet access is a different question. An entirely free app with no ads and no account has no reason to reach the network. An ad-supported app does — the ad SDK needs it — and that is a fair trade as long as the app says so plainly. What matters is the pairing: internet plus camera plus location on a flashlight is a combination worth walking away from.
TapLight
TapLight switches the LED with setTorchMode(), so it holds no camera permission at all — it cannot take a photo or see anything. The only runtime permission it asks for is Notifications, used for the ongoing "light is on" notification with an off button and for optional reminders you can switch off. It declares internet for the ad SDK and a foreground service that runs only while the light is on. No location, no contacts, no microphone, no storage. The compass uses the magnetic sensor, which needs no permission either.