tccd is the macOS privacy daemon (TCC stands for Transparency, Consent and Control): it shows the 'allow access' prompts and records your answers for the camera, microphone, screen recording, files and other protected data; it's part of macOS and safe. If an app keeps asking again or a permission won't stick, check the app in System Settings > Privacy & Security, or reset that app's decisions with tccutil.
Last reviewed · 2 sources
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /System/Library/PrivateFrameworks/TCC.framework/Support/tccd |
|---|---|
| Runs as | your user account and root |
| Signed by | Apple (Software Signing), identifier com.apple.tccd |
| Note | Two copies: one for the user, one for the system. |
tccd manages the macOS TCC (Transparency, Consent, and Control) framework — the privacy permission system that controls which apps can access your camera, microphone, screen recording, contacts, calendar, location, and other sensitive resources. When an app requests access, tccd presents the permission dialog and stores your decisions in the TCC database.
Permission dialogs not appearing when apps request access
Apps unable to access camera or microphone despite permissions being granted
TCC database corruption causing all permissions to reset
Accessibility or Screen Recording permissions silently failing
Go to System Settings > Privacy & Security and check each category relevant to the affected app. If the app is listed but not working, toggle the permission off and back on. Some permission changes require restarting the app.
Run 'tccutil reset All' in Terminal to reset all TCC permissions for all apps. You'll need to re-grant permissions to each app. For a single app, use 'tccutil reset All [bundle-id]'. This resolves most permission-related issues.
Run 'killall tccd' in Terminal to restart the TCC daemon. This can resolve cases where permission dialogs aren't appearing or where the daemon's in-memory state has diverged from the database.
Some apps need Full Disk Access (in System Settings > Privacy & Security > Full Disk Access) rather than specific folder permissions. Automation tools, backup software, and security apps commonly require this broader access level.
tccd prompting for permissions when apps first request access is normal and expected. Be concerned if you notice permissions being granted to apps you didn't approve, or if the TCC database is modified outside of normal system operations — this is a technique used by sophisticated macOS malware to silently grant themselves camera or microphone access.
With Full Disk Access, CoreLock's free Privacy report reads the permission records tccd keeps and lists the apps granted Screen Recording, Accessibility, Full Disk Access, Input Monitoring, camera and microphone. It shows what macOS granted, not what an app actually used.
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the networ...
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers ...
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL...
tccd is the daemon that manages all privacy permissions on macOS. Every time an app asks to use your camera, microphone, location, contacts, or other sensitive data, tccd is what shows the permission dialog, records your choice, and enforces it. Your decisions are stored in privacy databases: one for your user account in ~/Library/Application Support/com.apple.TCC/ and a system-wide one in /Library/Application Support/com.apple.TCC/.
Apps re-request permissions when the TCC database is reset (by a macOS update or manual reset), when the app's code signature changes (after an update), or when the app requests a new permission category it didn't need before. If an app keeps asking repeatedly, its bundle ID may be changing between launches, which is unusual.
TCC is a strong security boundary, but sophisticated malware has been found exploiting TCC bypass vulnerabilities. These are taken seriously by Apple and patched promptly. Keeping macOS updated is the best defense. With Full Disk Access, CoreLock's Privacy report lists which apps macOS has granted permissions such as the camera and microphone, so you can review them; a grant isn't proof of use, and it can't promise to detect a TCC bypass.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser