I can see how this whole subject is very difficult for non-technical people. I think phones should get more of a universal, easy to understand set of privacy choices that you can simply apply to all apps and only override on a case-by-case basis temporarily, instead of making it this kind of regular housekeeping chore.

That said, I'm also surprised a cryptography expert can't figure this all out:

> It’s sort of amazing to me how hard this has gotten, even on iOS, which advertises itself as the “privacy” OS.

Let's get this bit out of the way: iOS is the privacy OS. Android apps were using the camera in the background without user knowledge until Android P: https://www.theverge.com/2018/3/7/17091104/android-p-prevent...

And what percentage of Android users have Android P or above as we approach 2020? 30%? Less?

In the past, granular permissions did not exist in Android. You were simply given a list of permissions that any given app would simply use at any time and you either downloaded the app or you didn't.

Final example: Android lets apps simply write and read to/from the file system anywhere they want, until very recently (Android 10?). If I'm not mistaken, that means that any app that's granted permissions to the file system could just read common storage locations like your Facebook cache directory to gather personal information.

> My wife asked me how Facebook knew she walked by a particular store yesterday, so I dove into the Settings. What a mess.

iOS does not give these permissions away. The answer is obvious: his wife gave Facebook location access.

> First, there’s this “Privacy” tab in iOS settings, but under it you’ve got this ridiculous and ever-growing list of crap. Every app appears multiple times, and you have to know where to look.

On the one side of the ring, people ask Apple to make things simpler, and on the other side of the ring people ask Apple to expose more granular control. There's no winning here.

And anyway, the organization is quite logical. It's organized by permission category.

> Browsing the “Location Services” tab alone is a nightmare. There’s no way to sort by “Always”, which is usually the particularly bad permission you care about. (Although “While Using” is a bit ambiguous too.)

How many apps do you have where sorting is an issue here?

Also, "While Using" is not ambiguous. It means "While Using." The text on the original dialog was "While Using the App." What else could it mean?

This is an interesting criticism because it's another piece of granular location control that Android either doesn't have or gained very recently.

> And don’t get me started on this “Bluetooth” tab. Why do any of these apps need direct access to my Bluetooth other than crappy tracking?

Both iOS and Android basically gave away Bluetooth access because it was never assumed that it could be used for anything serious. We all know better now and Android 10 and iOS 13 both added this piece of granular permission in. I can tell you that my Sony Headphones app and Apple Music most definitely need access to Bluetooth.

> And even if you turn off location services for an app, the app may still get this data by examining the metadata from your photos. (I’m not sure if iOS13 fixes this.)

This is not necessarily something "to be fixed," this is simply the fact that granting access to your Photos grants access to your Photos. If you gave your photos metadata in the first place, that metadata will be there. I do admit that I'd love some more fine-grained control over this (although you may notice that the iOS share sheet does add some control over whether to include location data in iOS 13 - I wonder if any other popular smartphone operating systems have this built in and installed on >50% of their install base?)