How Android Storage Permissions Work: A Complete Guide

When you download a new app, the moment it asks to “access files” you probably wonder: what exactly is it getting permission to do? Android’s storage permissions have evolved a lot over the years, and the rules you see on your device today are a blend of legacy safeguards and newer, more granular controls. This guide walks through the essentials, from the old “external storage” model to the latest “Scoped Storage” approach, so you can judge whether an app’s request makes sense for you.

Why Storage Permissions Matter

At its core, a storage permission determines whether an app can read or write files outside its own sandbox. Without it, the app is limited to its private directory and can’t see your photos, downloads, or documents. That sounds convenient for privacy, but it also means many useful features—like a file manager or a photo editor—would break without explicit consent.

Google’s goal is to strike a balance: give apps enough access to be functional while keeping your personal data out of reach unless you say otherwise.

The Evolution of Android’s Storage Model

Legacy Model: READ/WRITE_EXTERNAL_STORAGE

Before Android 10 (API level 29), developers used two broad permissions:

• READ_EXTERNAL_STORAGE – lets the app list and open any file on shared storage.
• WRITE_EXTERNAL_STORAGE – grants both read and write capabilities.

These were “all‑or‑nothing” permissions, meaning once granted, an app could roam freely through your music, pictures, and documents. Not ideal for privacy, but simple to implement.

Scoped Storage: A More Granular Era

Starting with Android 10, Google introduced Scoped Storage. The idea is to confine each app to its own "scope" and only let it interact with other files through explicit user actions or well‑defined collections (e.g., MediaStore for photos and videos).

Key changes include:

• Limited direct file paths – apps must use content URIs instead of raw file system paths.
• Auto‑grant for media types – a photo‑editing app can access the MediaStore image collection without needing full write permission.
• MANAGE_EXTERNAL_STORAGE – a special “All Files Access” permission for apps that truly need unrestricted read/write, but Google Play now scrutinizes its use heavily.

Understanding the Permission Types You’ll See

When you open an app’s permission screen, the labels can be a bit cryptic. Here’s a quick primer:

• Files and media – covers both read and write for the MediaStore collections (photos, videos, audio).
• All files access – corresponds to MANAGE_EXTERNAL_STORAGE. Use it only if the app needs to manage arbitrary files, like a file explorer.
• Read external storage – the legacy permission still appears on older apps running on newer Android versions.

Notice the subtle distinction: “Files and media” is limited to designated media folders, while “All files access” opens the entire shared storage area.

How to Decide Whether to Grant

Not every request is created equal. Consider these quick checkpoints before tapping “Allow”:

• Is the app a media handler? Photo editors, music players, and video recorders usually need access to the corresponding media collection.
• Does the app act as a file manager? If so, it may legitimately request “All files access,” but verify that the developer is reputable.
• Is the permission part of the core functionality? A calculator app asking for storage access is a red flag.
• Can you achieve the same outcome with a “share” action? Some apps let you open a file via the system picker, bypassing the need for a permanent permission.

Best Practices for Developers

If you’re building an Android app, keep these tips in mind to avoid unnecessary permission prompts:

• Prefer the Storage Access Framework (SAF) for user‑selected files. It hands you a Uri with just enough rights for the chosen document.
• Target API level 30 or higher to automatically benefit from Scoped Storage.
• Only request MANAGE_EXTERNAL_STORAGE as a last resort, and provide a clear justification in your Play Store listing.
• Test your app on devices running Android 11 and 12, because the behavior around legacy permissions can differ.

Common Pitfalls and How to Fix Them

Even seasoned developers stumble over storage permissions now and then. Here are a few scenarios and simple solutions:

App Crashes on Android 11

Often this is caused by hard‑coded file paths like /sdcard/Download/. Switch to getExternalFilesDir() for app‑specific folders or use MediaStore APIs for shared media.

“Permission denied” When Opening a Screenshot

If you’re trying to read a screenshot saved in Pictures/Screenshots, make sure you request READ_EXTERNAL_STORAGE on devices below Android 10, or rely on the MediaStore query on newer versions. The requestLegacyExternalStorage flag can help during migration, but it’s being phased out.

Unexpected “All files access” Prompt

Check whether you truly need the broad permission. Often you can replace it with SAF’s Intent.ACTION_OPEN_DOCUMENT or Intent.ACTION_CREATE_DOCUMENT which let the user pick a location without granting blanket rights.

How to Revoke or Adjust Permissions

Changing your mind is easy. Open Settings → Apps → [App Name] → Permissions. From there you can toggle storage access on or off. On Android 12+, you’ll also see a “Nearby files” toggle for more granular control over which collections the app can see.

If an app misbehaves after you revoked a permission, it might crash or lose functionality—nothing to worry about, just reinstall if you still need it.

What the Future Holds

Google isn’t done tweaking storage rules. Upcoming Android releases hint at even tighter isolation, possibly moving toward sandboxed file access per‑app by default and eliminating the “All files access” backdoor altogether. Keeping your SDK up to date and watching the Android developer blog will help you stay ahead of the curve.