Do not hide the in-use light or icon after the grant

What it is

When the camera or microphone is on, the system lights an indicator the app cannot turn off: a status-bar green or orange dot, a hardware LED, a Control Center occupancy list. The app must not hide that fact with a full-screen mask, a fake status bar, a homemade "not in use" icon, or a window stacked over the indicator so the sensor looks off. This entry is only about not hiding media-sensor in-use indicators. It is not about whether the grant is Once or ongoing, and not about the permission row in app Settings.

Why it happens

The grant answers "may it open"; the indicator answers "is it open now." People use the indicator as a live audit: a green dot while they are not taking a photo is an anomaly. If the app can cover the indicator, post-grant supervision is cancelled, and silent capture becomes undiscoverable in the UI. A hardware LED is harder to fake because the app canvas cannot paint over the lamp. Hiding need not be malice: immersive full screen, a custom status bar, filling the notch can eat the dot in effect. For the person, effect and malice match—"being filmed or recorded" has left the field of view.

Studying it

With the camera or microphone actually open, vary window mode (full screen, custom status bar, picture-in-picture, last frame before lock) and measure whether people can point to "collecting now" within two seconds.

Independent variables: visibility of the system indicator, whether the app draws a conflicting status bar, whether both sensors are open. Dependent variables: detection of in-use, misreading the indicator as battery or network, detection delay.

Lab participants told to look for the indicator over-detect. It is more informative to have them do another task, then ask whether recording was on. Do not count an in-app red dot as "already has an indicator"—that glyph can be switched off, so it is not the system signal.

Where it stops holding

If the system indicator is magnified by assistive tech or mirrored by a screenshot tool, the app still must not cover it with another layer. Hardware LEDs on an external or desktop camera sit outside the app canvas; full screen must not claim "camera off" in contradiction to the lamp. Web full screen sometimes clips the browser's occupancy cue; the site should leave full screen or use an unsleepable system prompt in the content area, not a custom icon as a substitute.

Applying it

• While the camera or microphone is open, do not draw a mask over the status-bar safe area. Immersive playback still needs an edge the system indicator can occupy, uncovered by content.
• Do not show an in-app "not in use" that contradicts the system indicator. An extra "recording" glyph is allowed, but it cannot be the only signal, and it cannot have a toggle that hides it while capture continues.
• When both sensors are on, do not let one custom icon pretend camera and microphone have been distinguished—that distinction belongs to the system's occupancy list.
• Verify on a physical device: start capture, then enter full screen, landscape, a custom nav bar, and a modal. Photograph the status bar from a second device and check the dot is still visible. Ask uninvolved people whether filming or recording is on. A blocked or misread indicator fails.

Related

• Within the group: H4.08.1 Request camera and microphone separately; do not merge them as "media" · H4.08.3 Prefer the system capture UI for one-shot photos over a standing camera grant · H4.08.4 Silently using camera or microphone in the background is a serious trust breach
• Adjacent: O2.03 Sensor-Use Indicators · H4.10 Visibility of Permission State · H4.07 One-time vs Ongoing Authorization
• Search terms: privacy indicator · camera green dot · microphone in-use