What permissions does an NFC app need?
Less than people fear, and the structural protection matters more than the permission itself. An application sees a tag you deliberately presented to the phone. It cannot survey the room, and it cannot read tags you did not bring to it.
The app declares it
An application that uses NFC declares that it does, and the platform makes that visible.
It is not handled like the camera or location, where a prompt appears the first time and you decide. The mechanics differ between platforms and neither presents it as a recurring decision.
That surprises people who expect a prompt, and the reason there is no prompt is worth understanding rather than worrying about.
On Android the declaration is in the manifest, where an application asks for android.permission.NFC and may require the hardware with a uses-feature entry, both described in the Android documentation. The permission itself is never asked of the user. From Android 16, the NFC basics guide describes a notification the first time an app receives a tag, which lets the user stop that app receiving tags. From Android 17, an app that targets a newer SDK must also protect the activity that receives tags with android.permission.DISPATCH_NFC_MESSAGE, so that only the system's NFC service can start it. Apple grants the equivalent access through an entitlement on the application rather than through a prompt.
The protection is structural
NFC works over centimetres. An application cannot read a tag that is not physically against the phone, which means it cannot survey a room, a bag or a pocket at a distance.
Every tag an application sees is a tag someone deliberately brought to the phone. That is a stronger guarantee than a permission dialogue, because it does not depend on anyone's judgement in the moment.
Compare that with location or the microphone, where the capability genuinely extends beyond what the user is doing and a prompt is the only control.
So the absence of a prompt reflects the narrowness of the capability rather than an oversight.
What an app does see
The content of the tag you presented: the records and what they hold.
The technical data: the chip, the tag type, the free space, and the identifier the tag carries.
That identifier is worth noting. It is stable for a given tag, so an application reading your tags could recognise the same tag again. For your own tags that is a feature, and it is the reason to think before tapping an unfamiliar tag with an application you do not trust.
What it does not see is anything about tags you did not present, or anything about the phone beyond what any application already has.
Judging an app
Ask what it needs beyond NFC. A reading tool needs very little, and one asking for contacts, location and storage is asking for things unrelated to its job.
Prefer tools that read without acting, since that is what lets you examine an unfamiliar tag safely.
Be more careful about writing tools than reading ones, because writing changes physical objects and some changes are permanent.
And on a managed device, expect the choice to be made for you, since administrators commonly restrict what can be installed.
Frequently asked questions
Why does no permission prompt appear for NFC?
Because the capability only reaches a tag you physically presented. The narrowness is the protection, so a recurring prompt would add little. From Android 16, the first tag an app receives brings a notification offering to stop that app receiving tags, which is a choice about the app rather than a permission.
Can an app read tags in my bag?
No. NFC works over centimetres, so a tag has to be against the phone. There is no distance at which this becomes possible.
Can an app identify a tag it has seen before?
Yes, since tags carry a stable identifier. For your own tags that is useful, and it is a reason to be careful with unfamiliar ones.
Is a reading app safer than a writing one?
Reading changes nothing, while writing changes a physical object and some changes are permanent. Treat writing tools with more care.