What the "connection request" prompt means on Android

The Connection request dialog is Android's consent step for VPN apps. It says the app "wants to set up a VPN connection that allows it to monitor network traffic", asks you to accept only if you trust the source, and shows the key icon that will appear in the status bar while the VPN is active. Tapping OK grants the app permission to create a VPN tunnel on the phone. It is shown once per app, not on every connect, and Android shows the identical dialog for every VPN app, so its wording is a statement about what VPNs are, not a judgement about this one.

What you are actually granting

A VPN app on Android works through the system's VpnService API. When it connects, Android creates a virtual network interface and routes every app's traffic into it; the VPN app reads that traffic, encrypts it, and sends it to its server. That is the mechanism, and it is why the dialog uses the word "monitor": in order to carry your traffic, the app has to be handed your traffic.

So the permission is exactly one thing: the ability to be the phone's VPN. It does not include your contacts, files, location, camera or notifications. If a VPN app wants any of those, it must ask separately, in Android's ordinary permission dialogs, and you can refuse each one without affecting the VPN. Which permissions a VPN app actually needs lists what a VPN has a reason to ask for, which is short.

Why the wording is so stern

Android cannot tell a careful VPN from a careless one. Both need the same capability, and the capability is a powerful one: an app that is the phone's VPN sees the destination of every connection and, for anything not otherwise encrypted, the contents. Android's designers chose to make that plain rather than soften it, and they chose to say "trust the source" because trust in the developer is the only real protection.

That makes the dialog a prompt to do something, not just to tap. Before accepting, it is worth knowing who makes the app and what they say they do with what they see. A VPN's privacy policy is the document that answers that, and how to read one in ten minutes tells you what to look for. For Culvert VPN specifically, the answer is that it does not log the sites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id, never an account; and it does keep your client IP address for up to 30 days for abuse handling, all of which is set out in the privacy policy.

When it appears, and when it comes back

Android shows the dialog the first time an app asks to become the VPN. Once you tap OK, the app can connect and reconnect without asking again. The permission is revoked, and the dialog returns, in these cases:

• Another VPN app is granted. Android allows one VPN at a time, and accepting the dialog for a second app takes the permission away from the first. Switch back and the first app asks again.
• You tap Forget. In Settings > Network & internet > VPN (Samsung: Settings > Connections > More connection settings > VPN; other manufacturers vary), the gear icon next to an app offers a Forget or Remove option that revokes the grant.
• The app is uninstalled and reinstalled. A fresh install starts with no grant.
• You tapped Cancel. Nothing was granted; the app will ask again on the next connect attempt.

If you see the dialog unexpectedly during a session, the first case is the likely one: another VPN app on the phone, perhaps one you forgot about, connected and took over. How to set up a VPN on Android starts with ruling that out.

What it does not cover

Accepting the connection request does not turn on Always-on VPN or the traffic block. Those are separate system settings behind the same gear icon, and Android never sets them for you. It also does not give the app any special standing with the battery optimiser; a VPN can still be stopped in the background like any other app. Always-on VPN covers the settings that change that.

Some phones show a second, unrelated warning: "Network may be monitored", with a different icon. That one is about a user-installed certificate authority on the phone, which a VPN does not need. A VPN app that triggers it is doing something beyond being a VPN.

Revoking it

To take the permission away without uninstalling:

1. Open Settings > Network & internet > VPN, or the manufacturer's equivalent.
2. Tap the gear icon next to the app.
3. If Always-on VPN is on, turn it off first; Android will not forget an app that is set as always-on.
4. Tap Forget.

The app will show the Connection request dialog again the next time it tries to connect, and until you accept it, it cannot create a tunnel.

Reading the dialog as a test

The dialog is the same for every app, so it tells you nothing about the app. What does is how the app behaves around it. An app that asks for the VPN permission the moment you open it, before you have chosen to connect, is asking for something before it has a reason to. An app that asks only when you tap connect is asking at the right time. It is a small thing, and it is the kind of small thing that tends to line up with the larger ones.

Culvert VPN asks for the connection request only when you first tap connect, requests no permissions beyond what a VPN needs, and is on Google Play.