All device permissions should be opt-in from a checklist on first launch, and there should be an option to make your device pretend to opt-in but use fake data.

All device permissions should be opt-in from a checklist on first launch, and there should be an option to make your device pretend to opt-in but use fake data. "Can such-and-such app use your location?" "Sure, I am in the middle of the Pacific."