Multimodal AI turns smartphone permissions into personal profiles

A study of the Priva-See prototype shows how AI can combine ordinary smartphone permissions—photos, contacts, calendars, and location—into guesses about sensitive parts of a person’s life. The finding suggests that permission prompts must explain not only what an app collects, but what it may infer.

A phone permission asks whether an app may see your photos, contacts, calendar, or location. It does not ask what the app may work out from them. You might allow access so an app can organize pictures or show a map, while also exposing clues about medical care, family life, money, beliefs, or people close to you. The phone has asked about the ingredients, not the conclusions.

The permission system was built for collection

Phones normally keep apps in separate spaces. A permission opens a gate to sensitive material, such as a photo or a GPS location. This system was designed around raw data: what an app is allowed to take.

Profiling has usually needed many signals gathered over time, such as browsing, purchases, identifiers, and location histories. Multimodal AI changes the shape of that problem. A multimodal model can work with text, images, contacts, and location together. It can notice objects, relationships, and context in material that once needed separate tools or human review.

That does not make every conclusion true. An inference can be wrong, belong to a family member rather than the phone's owner, or cause harm if used for pricing, eligibility, targeting, or surveillance. But a plausible guess can still reveal something a person never meant to share.

A small sample can become a personal profile

Researchers tested this idea with Priva-See, a smartphone app connected to a server-side large language model, or LLM. In a US study approved by an ethics review board, 465 people submitted data. For each person, the prototype could use as many as 10 photos, 5,000 calendar and reminder events, 5,000 contacts, and a current location. On iPhones, reminders were included.

The system used one model for text and structured data and another that could analyze photos. It then produced statements about health, mental health, reproductive health, finances, legal issues, politics, religion, sexual orientation, relationships, and children. The statements could concern the user or someone close to them.

Participants judged 48.8% of the generated inferences completely accurate and 16.7% somewhat accurate. The point is not that the system knew everything. It is that a limited set of ordinary phone permissions gave it enough context to make useful personal guesses. The phone did not need a cross-site tracking system to build a profile; the clues were already on the device.

After participants saw the results, they felt less comfortable granting the permissions studied, especially access to the camera roll. Fifty-two percent said the experience would change how they handled permissions in the future.

What a clearer permission could show

Imagine installing an app on a phone. Instead of seeing only “Allow access to photos,” a parent might see a warning that selected screenshots and calendar entries could reveal a child’s treatment or a household’s financial status. That would make the real decision visible: not only whether the app may read the data, but what it may infer from it.

This future depends on operating systems and model providers making those downstream uses visible and enforceable before data leaves the device. The authors recommend warnings about likely inferences, transparency about which individual items were used, local warnings when newly created data is sensitive, and model rules against privacy-invasive inference.

Until those protections work, a permission prompt can promise a narrow exchange while hiding a much wider one. Consent to collect a photo or location is not automatically consent to turn it into a sensitive personal profile.

Sources

Privacy Leakage Through AI-mediated Analysis of Smartphone Data