[qwerty456127]

This doesn't express how a mobile app is essentially worse than a website - it only highlights how apps devs are doing it wrong and how mobile platforms vendors don't do their job preventing this.

Apps vendors should be discouraged from abusing access permissions, users should be warned if they probably do (in a visible and practical way) and be allowed to control them.

When a user clicks to install an app the system shows what rights does the app want and only gives choice to allow everything or just cancel. Instead it should disable everything by default, let the user turn particular permissions on explicitly and still install the app even if the user won't allow anything. It's the app vendor job to handle the cases when app can't access something.

As for TOSes - I doubt I understand why these should even be allowed by a platform. All the reasonable TOS terms are obvious and can be implied: the user can use the app for whatever is not illegal, the vendor can use whatever data the user enters the ways actually needed for the app to do its direct job (+ in non-personalized statistics calculation perhaps) and no other way.

[t0astbread]

> Instead it should disable everything by default, let the user turn particular permissions on explicitly

That would be great for power users but it wouldn't work for "the average dumb user" since they would just enable every permission when asked to do so if they don't know what it means and how it could be abused. And power users already have that in Android forks designed for them. (I can't speak for iOS.)

> All the reasonable TOS terms are obvious and can be implied

That's your definition of reasonable. With a rule like this a platform would kill off both freedom- and privacy-minded software as well as spyware (the general trackery), thus pissing off almost everyone who cares about those kinda things.