I think it's high time the host os takes responsibility for the privacy of sensitive things, such as contact lists and personal data.

One way could be to not return any identifiable information about others at all, but just a hash of each contact. (Kudos points if the host os returns a different hash for the same contact in different apps.) If that contact is known to the app, (because they've also installed it) then the app has all the information it needs to set up contact between two parties. The host os will probably need to provide a way to render a contact list for the app.

I'd be much happier with this arrangement. This way my personal data isn't uploaded to third parties simply because an acquaintance of mine wants to install some rubbish app. It's only if I install the same (rubbish) app will that third party finally get my personal info.

Host OS should also give me the power to determine what personal info it's given to any app. For instance, why did WhatsApp ever need my personal phone number while creating an account? It doesn't, and as such, should be regarded as an antitrust requirement.

At least on iOS Apple has an easy solution: just allow users to configure user groups per app! Then the user can create a WhatsApp group in contacts which may be empty or just a few entries.

But oddly enough Apple does not consider full-blown access to the contacts list as needing any kind of privacy settings.

Just as it doesn't consider per-app internet access as needing any privacy settings. I know for sure the flashlight-level app would need an 'always offline' toggle.

As well as access to the whole internet. I'd like to grant access to one domain, that I can match with the company that mkaes the app, and that's it!

Same with accessing all photos just to save or retrieve one photo.

I would hesitate to call it a feature. Realistically, nobody that I know would consider "analyzing my contacts to automatically suggest potential connections" an important or even productive feature. Certainly, nobody is switching to ToTok because of it. It is only a feature from the perspective of the platform holders; for a company like Facebook it is used to increase engagement (and thus ad revenue), and for ToTok it (allegedly) is used for surveillance.

In Europe any app that just reads your contact list and sends it to a remote server is in violation of GDPR. Companies write in their privacy policies "you guarantee that all of your contacts have agreed that you send their personal data to us" which is completely bonkus.

I rarely give out access to my contact list anymore but I do wonder is there any safe way to actually do what the original feature intended.

I'm new to a game. I'd like to play with my friends without having to individually contact every single one of them and ask them if they also play the game.