After the Cambridge Analytica scandal, Facebook decided to protect their user's data more. Therefore, if you would like to use some attributes of users, like gender and age_range, you need to explain to facebook how you would like to use these data.
Apps can access only a user's name, email address, and profile picture without App Review. All other permissions will require review by Facebook.
For example if you are sending targeted promotions to users based on their gender or age_range, you need to show them, how you are using these data. This can be done by making a screencast or video where you are actually showing this process and send it for review.
There are no general instructions on how to do this as each case is different. You need to make sure you have a valid use case and you need to show them why you need those data from facebook users.
Attributes that require a review:
After 1st of August, 2018 the following will not work at all:
checkins (you can use the share function instead), as publish_actions is deprecated in Graph API 3.0 and external apps can no longer create a post automatically in the user's name on their timeline
link to users' profiles (deprecated by Facebook)