Notification Access and "Draw Over Other Apps" Explained
Most Android permissions are granted in a pop-up when an app first needs them. A few powerful ones live in a separate "special app access" area of Settings, because they give an app unusual reach. Two of the most important are notification access, which lets an app read your notifications, and "display over other apps", which lets it draw on top of whatever is on screen.
- Notification access lets an app read, and sometimes dismiss, the notifications you receive, including message previews and one-time codes.
- "Display over other apps" lets an app draw on top of other apps; it has legitimate uses such as chat bubbles, but is also used in scams.
- Both are granted in special settings screens, not an ordinary pop-up, so they are easy to forget.
- Audit them every few months and remove them from apps that do not clearly need them.
Notification access
An app that implements NotificationListenerService can receive the notifications posted by other apps, and the user must switch it on in settings.[1] That includes the sender, text and sometimes a verification code shown in a preview.
Legitimate uses: smartwatch and car apps that show your notifications, automation tools, and some parental-control apps.
Why it deserves care: it can reveal private messages, banking alerts and one-time passwords, so give it only to apps you clearly trust.
Display over other apps
The SYSTEM_ALERT_WINDOW permission lets an app show a window on top of others.[2] Chat bubbles, screen recorders, floating note tools and some accessibility helpers use it.
The risk is that a malicious app can use an overlay to imitate another screen, such as a login or a payment button, or to cover what is really on screen. Our guide on screen overlay attacks goes into how that works. Android has added protections over time, but the permission is still best kept for apps that need it.
How these compare with other special access
| Special access | What it lets an app do |
|---|---|
| Notification access | Read your notifications. |
| Display over other apps | Draw on top of other apps. |
| Accessibility | Read the screen and act for you. More here. |
| Install unknown apps | Install other apps. More here. |
| Device admin | Enforce device policies and resist removal. |
How to audit them
- Open Settings and search for "Special app access".
- Open Notification access and Display over other apps in turn.
- Turn off any app you do not recognise or no longer use.
- If a game or utility has either one, check why before you decide.
Names differ by manufacturer, so use the search box if you cannot find them.
For parents
On a child's phone, these screens are a quick way to spot an app that has more reach than it should, or to confirm that a parental-control tool has what it needs. Explain what each setting means as you go, so your child learns the idea instead of just meeting a lock.
Who legitimately asks for these
- A smartwatch app asks for notification access to show your alerts on your wrist.
- A messaging app asks to draw over other apps so a chat bubble can float on screen.
- A screen-recording app asks to draw over other apps for its record button.
- A car or fitness app may ask for notification access to read out a message.
In each case the request matches the feature. When a plain game, wallpaper or cleaner asks for either one, the match is missing, and that is the moment to say no.
Frequently asked questions
What does notification access let an app do?
It lets the app read notifications from other apps, which can include message text and verification codes. You switch it on in special settings.
Is "display over other apps" dangerous?
Not always. Chat bubbles and screen recorders use it. It can be misused for fake screens, so give it only to apps that clearly need it.
Where do I find special app access?
Search for "Special app access" in Settings. The location varies by manufacturer and Android version.
Can I use my phone normally with these turned off?
Yes for most people. Apps that rely on them will ask you to enable them, and you can decide then.
Do parental-control apps use these permissions?
Some do, for features such as blocking or monitoring. Use apps from a company you can identify that explain what they need.
- NotificationListenerService — Android Developers — how apps read notifications once enabled.
- Manifest.permission (SYSTEM_ALERT_WINDOW) — Android Developers — the permission behind "display over other apps".