> So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. Apps under the new model will

> So each app will continue to ask for access to everything and you choose between being info-excluded or giving away your data. Apps under the new model will only ask for permissions when they need it. So, when you decide to post a picture to Facebook, that's when Android asks if you want to give the Facebook app access to your pictures on storage. If you deny it, it lets the app know it doesn't have access. If it's an older app that doesn't understand, it gets fake data as if you had no photos (or no contacts, etc). At least that was my understanding from reading about it. Note that this security model is similar to web apps wanting to "connect" with you Google account (or Twitter or Facebook for that matter) to access your contacts or similar.