The Short Read
Those colored dots in your status bar are privacy indicators. Apple's own description says the orange dot means "the microphone is being used by an app on your iPhone," and the green dot means "either the camera only or the camera and microphone are being used by an app on your iPhone." [1] Android shows a small green icon in the same spot on Android 12 and later for the same reason, using the same idea: a visible signal that camera or microphone hardware is currently in use by some app. [2]
If the indicator appears at a moment when you did not expect camera or microphone use, that is a real signal. The way to tell which app is responsible is built into the OS: tap or pull down on the indicator on iPhone, or open Settings then Privacy then Privacy dashboard on Android.
iPhone: what the orange and green dots actually mean
Apple's status indicator feature has shipped on every iPhone running iOS 14 and later. The Elcomsoft walkthrough of new iOS 14 privacy features is dated December 2020, the same iOS 14.x window that introduced the indicator. [3] Apple's own support page, "About the orange and green indicators in your iPhone status bar," gives the canonical, vendor-confirmed definitions.
Apple's description of the orange indicator: "An orange indicator means the microphone is being used by an app on your iPhone." [1] Apple's description of the green: "A green indicator means either the camera only or the camera and microphone are being used by an app on your iPhone." [1] The practical difference: green is camera (possibly plus microphone); orange is microphone without camera.
Apple ships a color-blind accessibility variant as well: the same indicator "appears as an orange square if the Differentiate Without Color setting is turned on in Settings > Accessibility > Display & Text Size." [1] That square means the same thing as the dot.
There is a known exception. When Siri is configured to listen in the background for the activation phrase, the orange dot is suppressed even though the microphone is open. The Elcomsoft walkthrough of iOS 14's privacy features flagged this behavior in December 2020. [3]
iPhone: find which app is using the camera or microphone
Apple's status icon is the surface layer. The next layer is Control Center, which shows which apps have recently used the camera and microphone. [3] Apple's documentation points at the related "status icons and symbols on your iPhone" page for the full surface. [1]
If the indicator appears when you were not using the app that normally uses the hardware, the right next step is to revoke the permission from the app. Apple's path is Settings, then Privacy and Security, then Microphone or Camera, then toggle off any app that does not need permanent access. Apps that get toggled off will prompt the user for permission again the next time the camera or microphone is required.
iPhone: app-level reasons the app can be using your camera or microphone
The dot is not a recording consent prompt and is not a permission grant on its own. The permission was set separately. Apple documents two relevant strings developers must include in their app's Info.plist: NSCameraUsageDescription and NSMicrophoneUsageDescription. Apple's developer reference describes these as required usage descriptions, plain-text strings the OS displays in the system permission dialog when the app first tries to access the camera or microphone.
In practice, the indicator tells the user that some app that previously got permission is currently calling that hardware. So a green dot while the phone is sitting on the table means some installed app is actively using the camera.
Android: the green indicator is the same idea, different color
Android 12 was the first Android release to ship the status bar indicator for camera and microphone access. Google's documentation for OEMs and developers describes the design: "Android provides users with transparency by displaying privacy indicators for the following types of access: Camera and microphone access... Location access." [2] The indicator shows up in the status bar, in roughly the same location as on iPhone.
The same Android source page specifies when the indicator counts as active. Camera and microphone accesses are treated as active "if they're either marked by the system as running, or are less than five seconds old." [2]
Android also has a separate secondary indicator, which Google's docs call "recent access indicators," that show "that an app accessed data during the prior 15 seconds." [2] That is the more subtle green flash that appears for a few seconds after an app finishes using the camera or microphone.
Android: find which app used the hardware
Unlike the transient status bar indicator, the Android Privacy Dashboard is the persistent record. The dashboard is a single settings screen, typically at Settings then Privacy then Privacy dashboard on a stock Android phone, that lists every app with access to a sensitive permission and timestamps its most recent use.
Camera and microphone access rests on the runtime permission system Google introduced with Android 6.0. Google's developer documentation says that if an app declares "dangerous permissions" and runs on "Android 6.0 (API level 23) or higher, you must request the dangerous permissions at runtime". [4] Each camera or microphone grant is one separate dialog, one separate toggle, revocable any time.
The idea: the live status bar dot only tells you what is happening now, while the dashboard shows recent history and leads to the permission controls.
Android: Camera and microphone also need a manifest entry
On Android, the camera and microphone are "dangerous" runtime permissions, which is the Android classification that triggers the user-facing prompt and the dashboard listing. The Android manifest requires the app declare those it needs: android.permission.CAMERA for the camera and android.permission.RECORD_AUDIO for the microphone. Both are runtime permissions the user has to grant. [4] If a Play Store app does not declare either of these and the dashboard lights up, something else is happening.
What "indicator appeared when I was not using the app" usually means
The honest reality: an unexpected indicator is more often an app that holds a one-time permission you never thought to revoke than a state-actor attack.
When the indicator is more than a malfunctioning app
The indicator is drawn by the operating system, not by the app. So seeing it means the OS sees the hardware as in use.
The two realistic threat models worth distinguishing from "stale permission":
- Commercial spyware and stalkerware: apps that obtained the permission, often through social engineering or by being pre-installed, hold it long term, and silently wake the hardware in the background. The indicator is the practical defense here. The status bar lights up; the user notices; the user revokes.
- Government-grade mobile spyware: tools like Pegasus, Predator, and the Intellexa suite exploited zero-click vulnerabilities in the phone OS itself to use the camera and microphone without ever going through the permission dialog. In that case the indicator may not appear at all, because an attacker who controls the OS also controls what it draws.
The implication is small but real: the indicators are very effective against ordinary apps and stalkerware. They are a partial defense at best against nation-state-level intrusions, and zero defense if the attacker has already compromised the OS itself.
What you can do in the next five minutes
- iPhone: Check which apps have permanent microphone or camera permission. Path: Settings then Privacy and Security then Microphone (or Camera). Revoke any app that does not need it.
- iPhone: If a dot lights up at a moment you cannot explain, open Control Center to see which app recently used the camera or microphone.
- Android: Open Settings then Privacy then Privacy dashboard. Tap any suspicious entry and revoke the underlying permission.
- Android: For any app on the dashboard you do not recognize having granted access to, uninstall it or revoke both Camera and Microphone in the app's permission settings.
- Both: For sensitive in-person conversations, the strongest move is still the oldest one. Putting the phone in a different room removes the microphone question entirely and removes the indicator question at the same time.
The bottom line
The orange and green dots in your phone's status bar are a real, vendor-shipped record of which apps are using your camera or microphone at the moment you look. Apple documents them; Google documents them; both are tied into the permission system that decides who can use that hardware in the first place. They catch ordinary stalkerware, sloppy background use, and forgotten permissions. They do not catch an attacker who has already broken into the OS itself. That is the honest limit of any single indicator-based defense.