"Is my webcam hacked?" is one of the most common security worries people have, and most of the time the honest answer is no, but the controls that prove it are rarely switched on. Webcam and microphone privacy means controlling which apps, websites and people can switch on a device's camera or microphone, and being able to see when they do. This guide explains how the indicator lights and permission systems in Windows, macOS, iPhone and Android actually work, what malware can and cannot do, why sextortion emails that claim to have filmed you are almost always bluffs, and what a sensible set of defences looks like. It is written for individuals, IT support teams and security practitioners who answer these questions for staff and family.
Key takeaways
- Indicators are your first check. Windows shows a camera light or notification and a taskbar microphone icon, iPhone shows an orange (microphone) or green (camera) dot, and Android 12 and later shows a green indicator you can tap to see which app is responsible.
- Permissions are the real control. Every major platform lets you switch camera and microphone access off globally and per app; review those lists rather than relying on a cover alone.
- Desktop apps are the weak spot on Windows. Classic desktop apps share one switch, Microsoft notes that some may not appear in the list, and they can be harder to control than store apps.
- Sextortion emails are guessing. The UK NCSC says senders do not know whether you have a webcam; the password they quote most likely came from an old data breach, not your device.
- Covers help cameras, not microphones. A sliding cover blocks video completely but does nothing for audio, which needs permission controls or a hardware disconnect.
What it is
Webcam and microphone privacy is the set of operating system controls, hardware features and habits that stop a camera or microphone being used without your knowledge. Three questions sum it up: who is allowed to turn the device on (permissions), how you know when it is on (indicators), and what you can do if something you do not trust gets access (removal and recovery).
Attackers who gain remote control of a computer can use it for surveillance. MITRE ATT&CK records this as T1125 Video Capture and T1123 Audio Capture, usually reached through malware or abused remote access software (T1219 Remote Access Tools). That risk is real, but it requires malicious software or someone with access to your device or accounts. Far more people are affected by scams that only claim it has happened.
How it works
Indicators by platform
| Platform | Camera indicator | Microphone indicator | How to see which app |
|---|---|---|---|
| Windows 11 and 10 | Camera light turns on if the device has one; if not, Windows shows a notification when the camera turns on or off | Microphone icon in the taskbar notification area while an app uses it | Settings, Privacy & security, Camera or Microphone lists desktop apps detected using the device |
| macOS | Camera indicator (a green light, or an on-screen indicator on some newer models); Apple's Platform Security Guide describes protections designed to stop software turning the camera on without the indicator | Per-app permission controls; Apple silicon and T2 laptops disconnect the microphone in hardware when the lid is closed | System Settings, Privacy & Security, Camera or Microphone shows apps that have asked for access |
| iPhone and iPad (iOS 14 or later) | Green dot when the camera is in use (alone or with the microphone) | Orange dot (orange square with Differentiate Without Colour) when the microphone is in use | Settings, Privacy & Security, Camera or Microphone lists apps with access |
| Android 12 and later | Green indicator in the top right corner | Same green indicator | Swipe down and tap the indicator to see the app; tap again to manage permissions; the privacy dashboard shows history (24 hours on Android 12, 7 days on Android 13) |
Permission layers
- Windows master switches: under Start, Settings, Privacy & security, Camera (or Microphone), "Camera access" turns the device off for everything. "Let apps access your camera" covers Microsoft Store apps, each with its own toggle. "Let desktop apps access your camera" (called "Allow desktop apps to access your camera" in Windows 10) is one switch for all classic desktop programs.
- Windows exceptions: Microsoft notes that Windows Hello face sign-in can use the camera even when app access is off, that some desktop apps may not appear in the list or may still access the device when the setting is off, and that turning off desktop app access can affect features such as dictation.
- macOS: on macOS Ventura and later, apps must be granted access per app under System Settings, Privacy & Security, Microphone (and Camera). Earlier versions use System Preferences, Security & Privacy, Privacy.
- Android Quick Settings: camera and microphone tiles turn off access for all apps at once. If they are missing, edit Quick Settings and drag them in. Google notes this may not work on all devices.
- Browsers: websites need their own permission. Microsoft's guidance notes that sites in Edge must be allowed separately even when Edge itself has access, and other browsers follow the same pattern. See the Browser Privacy and Security Settings Guide.
Hardware protections
Apple's platform security documentation states that Apple silicon Mac laptops and Intel Mac laptops with the T2 chip disconnect the microphone when the lid closes, implemented in hardware alone on Apple silicon laptops and T2 laptops from 2019 onwards. iPad models from 2020 do the same when a compatible case is closed. The camera is not disconnected, because Apple says its field of view is completely blocked with the lid closed. Some business laptops add physical privacy shutters or keyboard keys that cut the camera or microphone; check the manufacturer's documentation for what each actually disconnects.
Why it matters
- Remote access trojans: commodity malware commonly includes webcam and microphone capture. Indicators and permission lists are how a user notices; endpoint protection is how it gets stopped. See the AsyncRAT, Remcos and njRAT Commodity RATs Guide.
- Stalkerware and abusive partners: people with physical access to a phone can install monitoring apps that use the microphone or camera. See the Spyware and Stalkerware Guide.
- Over-permissioned apps: many apps request microphone or camera access once for a feature and keep it. Review these regularly. See the Mobile App Permissions.
- Workplace exposure: microphones in meeting rooms and laptops can capture confidential conversations. NIST SP 800-53 control SC-15 (Collaborative Computing Devices and Applications) expects organisations to prohibit remote activation of such devices except where explicitly allowed and to give users an explicit indication of use.
- Scams and extortion: fear of being filmed is used to extort money even when nothing was recorded.
Common misconceptions
| Myth | Reality | What to do |
|---|---|---|
| "This email has my password, so they must have hacked my webcam." | The NCSC says the password was most likely taken from past breaches of personal data, and the sender is guessing about webcams and browsing | Do not pay or reply; forward to [email protected] (UK) and delete; change that password everywhere it is used |
| "A tape or cover makes me private." | A cover blocks video only; the microphone keeps working | Use a cover for the camera plus microphone permissions or hardware mute |
| "If the light is off, nothing is recording." | Indicators are strong on modern phones and Macs, but Microsoft notes that desktop apps can be harder to account for on Windows, and older or external webcams vary | Check the permission list and recent-use list, not the light alone |
| "Antivirus will tell me if my camera is used." | Security software may detect malware but does not necessarily alert on every legitimate camera use | Use operating system indicators and permission reviews as well |
| "Turning off app access covers everything." | Windows Hello and browser site permissions are handled separately | Review browser site settings too |
If you receive a sextortion email
- Do not reply or pay. The NCSC warns that paying marks you as a willing target and is likely to bring more scams.
- Forward the email to the NCSC Suspicious Email Reporting Service at [email protected], then delete it. Outside the UK, use your national reporting route; see the Consumer Reporting Routes Map.
- Check whether your email address appears in known breaches (the NCSC points to haveibeenpwned.com) and change any password the email quotes that you still use.
- Turn on multi-factor authentication for email and important accounts.
- If you have already paid, the NCSC advises reporting to local police on 101. Victim Support offers emotional support on 0808 168 9111.
Sextortion that involves real images, for example after a conversation on a dating app or social platform, is a different and serious crime. See the Sextortion guide for that situation.
If you think your camera really is being used
- Check the recent-use list (Windows desktop app list, Android privacy dashboard) for apps you do not recognise.
- Revoke camera and microphone access for anything unexpected and uninstall software you did not install, including unfamiliar remote access tools.
- Run a full scan with up-to-date security software and install operating system updates.
- Change passwords from a different, trusted device and review account sign-in history.
- If stalkerware or a remote attacker is suspected and you are at risk, get specialist help before removing anything, because removal can alert the person monitoring you. See the Mobile Spyware Infection Response Playbook.
Related concepts
- Least privilege for apps: give camera and microphone access only to apps that need it and only while in use, the consumer equivalent of NIST SP 800-53 AC-6 Least Privilege.
- Managed devices: organisations can enforce camera and microphone policy through mobile device management and endpoint configuration, and map it to NIST CSF 2.0 PR.AA-05 (access permissions managed and reviewed).
- Smart speakers and home cameras: always-listening devices and IP cameras raise the same questions on a different platform. See the Securing Home Cameras Guide and the Smart Home Security Guide.
- Phone settings: for full privacy walkthroughs see the iPhone Security and Privacy Settings Guide and the Android Security and Privacy Settings Guide.
Framework mapping for organisations
| Risk | Reference | Control in practice |
|---|---|---|
| Covert video capture | ATT&CK T1125 | Endpoint protection, camera permission policy, alerting on unusual processes using the camera |
| Covert audio capture | ATT&CK T1123 | Microphone permission policy, hardware mute in meeting rooms |
| Abused remote access software | ATT&CK T1219 | Allow-list approved remote support tools, block others |
| Remote activation of collaboration devices | NIST SP 800-53 SC-15 | Prohibit remote activation, visible in-use indication |
| App over-permissioning | NIST SP 800-53 AC-6; CSF 2.0 PR.AA-05 | Periodic permission reviews, MDM policy |
Measuring it in an organisation
- Percentage of managed devices with a camera and microphone policy enforced by MDM.
- Number of unapproved remote access tools detected per month, trending down.
- Sextortion and phishing reports forwarded by staff, with time to triage.
- Apps holding microphone permission without a business need, found in quarterly reviews.
Practitioner checklist
- Learn the indicator for each platform you support and teach users what it means.
- On Windows, review Store app toggles and decide whether desktop app access should be on.
- Review camera and microphone permissions on phones and Macs at least quarterly.
- Add the Android camera and microphone Quick Settings tiles for quick global shut-off.
- Check browser site permissions for camera and microphone.
- Fit a camera cover where users want one, and explain that it does not cover audio.
- Give staff a standard reply for sextortion emails: do not pay, report, change the password.
- Block unapproved remote access tools and keep endpoint protection current.
Standards and references
- Microsoft: Windows camera, microphone and privacy
- Apple: About the orange and green indicators in your iPhone status bar
- Apple Platform Security: Hardware microphone disconnect
- Apple Platform Security: Mac on-screen camera indicator light
- Google: Check if your Android camera or microphone is on or off
- NCSC: Sextortion scams, how to protect yourself
- MITRE ATT&CK: Video Capture
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Mobile App Permissions · Spyware and Stalkerware Guide · Securing Home Cameras Guide · Recognising Tech Support Scams Guide