Mobile App Runtime Permissions and the Privacy Paradox: Hot-State Decisions, Digital Literacy, and Consumer Consent

Abstract

Runtime permission prompts are intended to enable informed privacy choices, yet they interrupt consumers mid-task and may undermine meaningful consent. We examine this issue among Chinese Android users in a mixed-methods study. Study 1 (N = 525) combined a survey with a custom app that tracked whether 15 mainstream apps requested key runtime permission types (e.g., location, camera, microphone) over 2 weeks and whether consumers granted or denied those requests. Privacy concerns did not predict the permission grant rate, while digital literacy was positively associated with granting more permissions. Study 2 (18 interviews) explains these patterns: hot-state interruptions create cognitive overload and functional pressure, leading to coping heuristics (e.g., vendor/government trust) and contextual resignation. Digitally literate “power users” grant more permissions due to feature dependence and perceived controllability (e.g., revoking later). Findings suggest consumer education alone is insufficient; designs and policy should reduce cognitive burden and constrain coerced consent.