API 23 Decoded: The Android Milestone That Redefined Privacy, Power, and Permissions

When Google rolled out Android 6.0 Marshmallow and established API Level 23 in late 2015, it looked outwardly like an incremental polish of the previous Android Lollipop release. Beneath the surface, however, API 23 was a seismic architectural shift. It addressed two of the biggest pain points in mobile computing at the time: rampant battery drain during idle times and an all-or-nothing privacy model that left users blind to how apps used their personal data.

For developers and users alike, API 23 drew a hard line between the “Wild West” era of early Android and the modern, security-conscious ecosystem we navigate today.

1. The Death of the Install-Time Monopoly: Runtime Permissions

Before API 23, Android’s permission model was rigid and unforgiving. When a user went to the Google Play Store and clicked “Install” on an app, a massive wall of text appeared detailing every permission the app might ever need—accessing the camera, reading contacts, tracking location, or reading SMS messages.

It was an absolute binary choice: accept all of them or don’t install the app at all. Naturally, users routinely clicked through blindly, and malicious or poorly written apps took advantage of this blanket trust to hoard private data in the background.

API 23 completely shattered this paradigm by introducing Runtime Permissions.

• Contextual Asking: Instead of demanding permissions at installation, apps targeting API 23 had to ask for sensitive permissions at the exact moment the feature was needed. If a user opened a photo-editing app and tapped “Take a Picture,” that was when the system prompt for camera access finally appeared.
• Granular Control: Users could now grant or deny individual permissions and change their minds at any time by diving into the system settings, without having to uninstall the app entirely.

The Architecture: Normal vs. Dangerous

API 23 categorized system permissions into distinct protection levels:

• Normal Permissions: Low-risk actions (like accessing the internet) that do not directly risk user privacy. These are still automatically granted at installation.
• Dangerous Permissions: High-risk actions grouped into logical categories (such as CALENDAR, CAMERA, CONTACTS, LOCATION, and STORAGE). Requesting any single permission within a group automatically unlocked the others in that group, streamlining the user prompt experience.

2. Taming the Background Drain: Doze Mode and App Standby

Before smartphones became multi-day powerhouses, battery life management was a constant struggle. Background apps loved to wake up CPUs, ping servers, and drain power even when the phone sat untouched on a desk. API 23 introduced two aggressive system-level power conservation tools:

• Doze Mode: If the system detected that a device was unplugged, stationary, and had its screen turned off for an extended period, it entered Doze mode. Instead of letting every app run rampant, the system periodically throttled network access and CPU-intensive tasks into brief, coordinated maintenance windows.
• App Standby: For applications that users hadn’t interacted with for a while, the system placed them into an idle “Standby” state. Network access was completely cut off and background syncs were suspended until the user explicitly picked up the app again.

These features fundamentally transformed Android’s standby battery efficiency, setting the blueprint for the deep sleep states used in modern mobile operating systems today.

3. Under the Hood: Cleanups, Deprecations, and Privacy

API 23 wasn’t just about user-facing prompts; it also forced developers to write cleaner, more secure, and forward-looking code.

• Removal of the Apache HTTP Client: Google officially excised the legacy Apache HTTP client from the Android SDK. Developers were nudged toward the more efficient HttpURLConnection class, which inherently reduced network overhead, enabled transparent response caching, and conserved battery.
• Hardware Identifier Masking: To protect user privacy from aggressive tracking scripts, API 23 blocked programmatic access to local hardware identifiers. Methods like WifiInfo.getMacAddress() and BluetoothAdapter.getAddress() began returning a static, anonymous constant (02:00:00:00:00:00) unless the app held explicit location permissions.

The Lasting Legacy of API 23

Looking back, API 23 was the inflection point where Android matured from a wide-open, feature-rich OS into a structured, privacy-first platform.

While modern versions of Android have built extensively upon these foundations—adding features like scoped storage, one-time permissions, and strict background execution limits—nearly every modern privacy guardrail we take for granted today traces its lineage right back to the runtime permission model introduced by API 23.