Project: Privacy and Permissions Audit

Build the mental model

This project combines privacy-fundamentals (data footprint) with app-permissions-and-tracking (app permissions, browser tracking). Neither lesson alone gives the full picture of your exposure — this project asks you to combine them into a structured audit of your accounts and devices.

Cybersecurity Basics' projects looked at authentication (password, 2FA) and phishing recognition. Neither touches privacy exposure — app permission mismatches, browser tracking, live third-party connections, profile visibility, or forgotten sessions.

Category	What It Checks
Apps & Permissions	Whether each app's permissions match its stated purpose
Browser Tracking	Cookie and tracking-protection settings across your browser
Connected Apps	Third-party integrations still connected to your main accounts
Account Visibility	Who can see your profile and posts by default
Active Sessions	Which devices or sessions are still logged in

Record concrete findings per category and feed them into a prioritized improvement list — an audit with no ranked action items is just an interesting read.

text

PRIVACY AND PERMISSIONS AUDIT
-----------------------------
PRIVACY AND PERMISSIONS AUDIT
-------------------------------
APPS & PERMISSIONS      ---+
BROWSER TRACKING        ---+
CONNECTED APPS          ---+---> PRIORITIZED IMPROVEMENT LIST
ACCOUNT VISIBILITY      ---+
ACTIVE SESSIONS         ---+

Connect it to a real scenario

Treat this as a five-category sweep across your own devices and accounts — spend a few focused minutes per category and write down what you actually find.

Apps and permissions

Open your phone's permission settings and list five to ten apps alongside what they can access and what they are actually for — a flashlight app requesting contacts is a mismatch worth flagging.

Browser tracking

Check whether third-party cookies are blocked, whether a tracking-protection feature is on, and how many trackers a typical page load blocks.

Connected apps

Open the 'connected apps' or 'third-party access' page for your main email and social accounts and note anything unused for six months or more.

Account visibility

Check account visibility settings on your main social account — who can see your posts and profile by default.

Active sessions

Open the active-sessions or 'where you're logged in' page for two or three important accounts and note any device you do not recognize.

Feed your five categories of findings into the audit function below and compare its prioritized report to your own read of the risk.

Privacy exposure and authentication security are different layers — a strong password doesn't fix an over-permissioned app
A permission or integration that made sense once can quietly become unnecessary over time
A structured five-category sweep finds more than a general 'check my privacy' impulse ever will

Try the working example

javascript

function buildPrivacyReport(apps, integrations, today) {
  const now = new Date(today);

  const permissionFindings = apps
    .map((app) => {
      const unjustified = app.permissions.filter((p) => !app.justifiedPermissions.includes(p));
      return { app: app.name, unjustifiedPermissions: unjustified };
    })
    .filter((f) => f.unjustifiedPermissions.length > 0);

  const integrationFindings = integrations
    .map((i) => {
      const daysSinceUse = Math.floor((now - new Date(i.lastUsed)) / 86400000);
      return { integration: i.name, daysSinceUse };
    })
    .filter((f) => f.daysSinceUse > 180);

  const findings = [
    ...permissionFindings.map((f) => ({
      category: "App Permissions",
      subject: f.app,
      severity: f.unjustifiedPermissions.length * 3,
      detail: `Requests ${f.unjustifiedPermissions.join(", ")} beyond its stated purpose`,
    })),
    ...integrationFindings.map((f) => ({
      category: "Connected Apps",
      subject: f.integration,
      severity: Math.min(5, Math.floor(f.daysSinceUse / 90)),
      detail: `Unused for ${f.daysSinceUse} days -- still has account access`,
    })),
  ];

  findings.sort((a, b) => b.severity - a.severity);
  return findings.map((f, i) => ({ priority: i + 1, ...f }));
}

// Described apps/integrations -- names and permissions only, never real login data.
const apps = [
  { name: "Flashlight Pro", permissions: ["camera", "contacts"], justifiedPermissions: ["camera"] },
  { name: "Messaging App", permissions: ["contacts", "microphone", "camera"], justifiedPermissions: ["contacts", "microphone", "camera"] },
  { name: "Weather Widget", permissions: ["location", "contacts"], justifiedPermissions: ["location"] },
];

const integrations = [
  { name: "Old Quiz App", lastUsed: "2024-11-01" },
  { name: "Cloud Storage Sync", lastUsed: "2026-08-20" },
  { name: "Fitness Tracker", lastUsed: "2025-02-14" },
];

const report = buildPrivacyReport(apps, integrations, "2026-09-06");
for (const item of report) {
  console.log(`#${item.priority} [${item.category}] ${item.subject} (severity ${item.severity})`);
  console.log(`   ${item.detail}`);
}

You should see

The function returns four findings ranked by severity: 'Old Quiz App' and 'Fitness Tracker' tie at severity 5 (674 and 569 days unused) ranked #1 and #2, followed by 'Flashlight Pro' and 'Weather Widget' tied at severity 3 for requesting the unjustified 'contacts' permission — matching the console output above.

5-minute try-it

Describe three to five of your own installed apps (name, requested permissions, stated purpose) and two or three connected integrations (name, last-used date) — never real account credentials — and run buildPrivacyReport on them. Rank the results and pick the top two fixes to actually make this week.

One important caution

Auditing permissions once and never revisiting them, even though apps request new permissions and integrations quietly accumulate over time

Flagging a permission mismatch or a stale integration but never actually revoking access — a finding that is never acted on protects nothing

EFF — Surveillance Self-Defense — Digital Privacy & Modern Security