Permissions are forever, until you say otherwise
Most people click "Allow" on a camera, microphone, or location prompt without a second thought — usually because they're mid-task and the popup is blocking what they actually wanted to do. What almost nobody does afterward is go back and check what they said yes to. Unlike a cookie that expires or a session that times out, a browser site permission just sits there, active, until you manually revoke it.
That means the video-call site you used once for a job interview two years ago may still have standing camera access. The weather app you tried and abandoned may still know your location every time you visit. None of this shows up anywhere unless you go looking.
Why this matters more than it seems
The risk isn't usually a site actively spying on you right now — it's the accumulated surface area. Every permission you've ever granted and forgotten about is one more thing that could be misused if that site is ever compromised, sells its userbase to a different owner, or quietly changes what it does with camera or mic access in a future update you never notice.
Where to actually look
Every major browser keeps a per-permission settings page, though the paths differ:
- Chrome:
chrome://settings/content/camera(swap "camera" for microphone, location, or notifications) - Firefox:
about:preferences#privacy→ Permissions section - Edge:
edge://settings/content/camera - Safari: Safari → Settings → Websites, then pick a permission category in the sidebar
Each page lists every site with an active grant, along with an option to revoke it. The trick isn't finding the page — it's actually remembering to look, and knowing what counts as suspicious once you're there.
Spotting the red flags
Not every permission a site holds is a problem. A video-conferencing tool needing your camera makes sense. A few patterns are worth specific attention:
- A text-only news or blog site holding camera access — articles don't need to see you.
- A single-purpose calculator or converter site with microphone access.
- A static document or PDF viewer with location access.
- Notification permission granted the instant a page loaded, before you clicked anything — a known dark-pattern prompt design.
- Any site you don't recognize the name of anymore holding any permission at all.
A five-minute habit worth keeping
You don't need to audit this weekly. Once every few months is enough to catch what's accumulated. Go category by category, ask yourself honestly whether you still use the site and whether the permission still makes sense, and revoke anything that fails either test. If a site genuinely needs it again later, it will simply ask — that's the whole point of the permission model working as designed.
Building the habit into something repeatable
The hardest part of any privacy audit isn't the technical steps — it's remembering to do it and having a consistent process each time so you don't miss a category. A structured checklist that walks through camera, microphone, location, and notifications one at a time, with the exact settings path for your browser next to each one, turns a vague "I should check this sometime" into something you can actually finish in one sitting.
What happens after you revoke
Revoking a permission doesn't delete your history with a site, and it doesn't retroactively undo anything that site already did with the access it had. What it does is close the door going forward — the site can no longer silently use that capability the next time you visit, and if it still has a legitimate reason to need it, it will prompt you again, which gives you a fresh, informed decision to make instead of a stale grant running on autopilot. That's really the whole value of the exercise: not paranoia about any one site, but making sure every permission currently active is one you'd actually choose again today, not one you clicked past years ago and never thought about since.
It's also worth extending the same habit to permissions you grant going forward. Many browsers let you set the default behavior for new requests to "ask every time" rather than a broader default — this doesn't stop you from saying yes when a site has a good reason, it just means each future grant stays a deliberate choice rather than something that happens by default before you've had a chance to think about it.
Frequently Asked Questions
No — browsers deliberately block web pages from reading another site's permission grants, which is a security boundary, not a limitation of this tool. Instead it gives you the exact settings path for Chrome, Firefox, Edge, and Safari and walks you through checking each category yourself.
Yes — the Browser Site Permission Auditor gives you a structured checklist covering camera, microphone, location, and notification access, plus red-flag examples of mismatched permission requests. It's a one-time $4.99 purchase — no subscription, no account required.
Only if you're still actively using a feature that needs it. Most sites simply re-prompt you the next time that permission is genuinely needed, so revoking something you're not sure about is low-risk — you can always re-grant it.
No. Everything runs locally in your browser using localStorage only. There are no network requests, analytics, or tracking — you can verify this yourself by viewing the page source.
The core checklist focuses on browser site permissions, but the guidance section reminds you to also check OS-level app permissions in your phone's Settings → Privacy menu, since those are managed separately from browser permissions.