They could fake it, the way Cyanogenmod does, e.g. return null data to apps if the user doesn't want the app to have a particular permission.