The Short Read
Those colored dots in your status bar are privacy indicators. Apple's own description says the orange dot means "the microphone is being used by an app on your iPhone," and the green dot means "either the camera only or the camera and microphone are being used by an app on your iPhone." [1] Android shows a small green icon in the same spot on Android 12 and later for the same reason, using the same idea: a visible signal that camera or microphone hardware is currently in use by some app. [2]
If the indicator appears at a moment when you did not expect camera or microphone use, that is a real signal. The way to tell which app is responsible is built into the OS: tap or pull down on the indicator on iPhone, or open Settings then Privacy then Privacy dashboard on Android.
iPhone: what the orange and green dots actually mean
Apple's status indicator feature has shipped on every iPhone running iOS 14 and later. The Elcomsoft walkthrough of new iOS 14 privacy features is dated December 2020, the same iOS 14.x window that introduced the indicator. [3] Apple's own support page, "About the orange and green indicators in your iPhone status bar," gives the canonical, vendor-confirmed definitions.
Apple's description of the orange indicator: "An orange indicator means the microphone is being used by an app on your iPhone." [1] Apple's description of the green: "A green indicator means either the camera only or the camera and microphone are being used by an app on your iPhone." [1] The practical difference: green is camera (possibly plus microphone); orange is microphone without camera.
Apple ships a color-blind accessibility variant as well: the same indicator "appears as an orange square if the Differentiate Without Color setting is turned on in Settings > Accessibility > Display & Text Size." [1] That square means the same thing as the dot.
There is a known exception. When Siri is configured to listen in the background for the activation phrase, the orange dot is suppressed even though the microphone is open. The Elcomsoft walkthrough of iOS 14's privacy features flagged this behavior in December 2020. [3] Voice dictation while typing also lights the orange dot on iOS.
iPhone: find which app is using the camera or microphone
Apple's status icon is the surface layer. The deeper record is the system sheet that shows which app the OS says is using the hardware, accessible from Control Center in current iOS versions. Apple's documentation points at the related "status icons and symbols on your iPhone" page for the full surface. [1]
The authoritative record of every app that has used the hardware, going back further than the live indicator, lives in Apple's Screen Time area and the dedicated "Record App Activity" feature available on iOS 15 and later. Both log microphone and camera use across all apps, not only the apps that are currently using the hardware.
If the indicator appears when you were not using the app that normally uses the hardware, the right next step is to revoke the permission from the app. Apple's path is Settings, then Privacy and Security, then Microphone or Camera, then toggle off any app that does not need permanent access. Apps that get toggled off will prompt the user for permission again the next time the camera or microphone is required.
iPhone: app-level reasons the app can be using your camera or microphone
The dot is not a recording consent prompt and is not a permission grant on its own. The permission was set separately. Apple documents two relevant strings developers must include in their app's Info.plist: NSCameraUsageDescription and NSMicrophoneUsageDescription. Apple's developer reference describes these as required usage descriptions, plain-text strings the OS displays in the system permission dialog when the app first tries to access the camera or microphone.
In practice, the indicator tells the user that some app that previously got permission is currently calling that hardware. So a green dot while the phone is sitting on the table means some installed app is actively using the camera. A quick way to find out which one is to disable network and microphone access for the most suspicious apps one at a time and watch when the dot disappears.
Android: the green indicator is the same idea, different color
Android 12 was the first Android release to ship the status bar indicator for camera and microphone access. Google's documentation for OEMs and developers describes the design: "Android provides users with transparency by displaying privacy indicators for the following types of access: Camera and microphone access... Location access." [2] The indicator shows up in the status bar, in roughly the same location as on iPhone.
The same Android source page specifies when the indicator counts as active. Camera and microphone accesses are treated as active "if they're either marked by the system as running, or are less than five seconds old." [2] Touch the indicator and the system surfaces a sheet of which apps have used the hardware recently.
Android also has a separate secondary indicator, which Google's docs call "recent access indicators," that show "that an app accessed data during the prior 15 seconds." [2] That is the more subtle green flash that appears for a few seconds after an app finishes using the camera or microphone. Both indicators are designed to fire before the user could plausibly miss them.
Android: find which app used the hardware
Unlike the transient status bar indicator, the Android Privacy Dashboard is the persistent record. The dashboard is a single settings screen, typically at Settings then Privacy then Privacy dashboard on a stock Android phone, that lists every app with access to a sensitive permission and timestamps its most recent use.
The dashboard is explicitly linked to the runtime permission system Google shipped in Android 6.0 in 2015. Google's own developer documentation says: "With Android 6.0 (API level 23) and higher, the runtime permission model is used. Users are prompted to grant permissions to apps while the app is running, not just when they install it." [4] Each camera or microphone grant is one separate dialog, one separate toggle, revocable any time.
The Android dashboard is the closest analog to Apple's "Record App Activity" feature and is built on the same idea: the live status bar dot only tells you what is happening now, but the dashboard tells you what happened in the last day, who did it, and how to kill the permission.
Android: Camera and microphone also need a manifest entry
On Android, the camera and microphone are "dangerous" runtime permissions, which is the Android classification that triggers the user-facing prompt and the dashboard listing. The Android manifest requires the app declare those it needs: android.permission.CAMERA for the camera and android.permission.RECORD_AUDIO for the microphone. Google documents both as protected permissions requiring explicit user grant. [4] If a Play Store app does not declare either of these and the dashboard lights up, something else is happening.
What "indicator appeared when I was not using the app" usually means
The honest reality: an unexpected indicator is more often an app that holds a one-time permission you never thought to revoke than a state-actor attack. The most common culprits in published reports and user threads are apps that came with the phone, apps that hold "while using the app" permission for camera or microphone features you rarely trigger, and apps that hold ambient background access they were never fully cut off from.
The same Android documentation flags a detail worth knowing: even when an app has been revoked the permission, its SDK code can occasionally attempt to start the hardware on launch, and the OS denies it but the SDK still calls the API. That produces no indicator. The indicator only fires for granted access.
When the indicator is more than a malfunctioning app
The status bar dot is hard to fake on a stock phone. Apple's own iOS and Google's stock Android both require the platform to draw the indicator, which an app cannot override. So seeing the indicator at all means the OS sees the hardware as in use by something with permission.
The two realistic threat models worth distinguishing from "stale permission":
- Commercial spyware and stalkerware: apps that obtained the permission, often through social engineering or by being pre-installed, hold it long term, and silently wake the hardware in the background. The indicator is the practical defense here. The status bar lights up; the user notices; the user revokes.
- Government-grade mobile spyware: tools like Pegasus, Predator, and the Intellexa suite exploited zero-click vulnerabilities in the phone OS itself to use the camera and microphone without ever going through the permission dialog. In that case the indicator may not appear at all, because the indicator only fires for granted access. Citizen Lab and the EFF have documented this gap on iOS specifically. [5]
The implication is small but real: the indicators are very effective against ordinary apps and stalkerware. They are a partial defense at best against nation-state-level intrusions, and zero defense if the attacker has already compromised the OS itself.
What you can do in the next five minutes
- iPhone: Check which apps have permanent microphone or camera permission. Path: Settings then Privacy and Security then Microphone (or Camera). Revoke any app that does not need it.
- iPhone: If a dot lights up at a moment you cannot explain, open Control Center to see which app the system says is using the hardware.
- Android: Open Settings then Privacy then Privacy dashboard. The screen shows every camera or microphone access in the last 24 hours with timestamps. Tap any suspicious entry and revoke the underlying permission.
- Android: For any app on the dashboard you do not recognize having granted access to, uninstall it or revoke both Camera and Microphone in the app's permission settings.
- Both: For sensitive in-person conversations, the strongest move is still the oldest one. Putting the phone in a different room removes the microphone question entirely and removes the indicator question at the same time.
The bottom line
The orange and green dots in your phone's status bar are a real, vendor-shipped record of which apps are using your camera or microphone at the moment you look. Apple documents them; Google documents them; both are tied into the permission system that decides who can use that hardware in the first place. They catch ordinary stalkerware, sloppy background use, and forgotten permissions. They do not catch an attacker who has already broken into the OS itself. That is the honest limit of any single indicator-based defense.
References
- Apple Support: About the orange and green indicators in your iPhone status bar (May 27, 2026)
- Android Source: Privacy indicators (last updated July 13, 2026)
- Elcomsoft: New Privacy Features in iOS 14.0 through 14.3 (December 2020)
- Android Developers: Request runtime permissions
- Electronic Frontier Foundation: What an Orange (or Green) Dot on Your iPhone Means (April 28, 2021)