What it means
Apps that target Android 17 or higher (API level 37+) may only request the READ_CONTACTS permission if the Android Contact Picker is not sufficient for your app to provide core functionality.
Play Console Help, permissions and APIs that access sensitive information
The policy is new and only concerns apps that target API 37 (Android 17) or higher. Google lists the uses it expects to need broad access: contact management, dialing or SMS, call history, CRM, call screening, accessibility, personal assistants, friend matching, backup and restore, auto-complete. Inviting or sharing with one contact the user selects is what the Contact Picker is for.
The store check reports the permission and the target API read from the manifest. It cannot tell whether the picker would be enough for your feature, or whether the declaration was submitted: the finding is a warning, never a blocker.
Deadline
From January 27, 2027, as listed in Google's Play policy deadlines. The store check applies the rule from that date; before it, the finding is titled "Required from" the date. It is never a blocker: what Google requires is not in the binary. Google also states that a 30-day self extension will be available in Play Console, and the rule only applies once the app targets API 37.
How to fix it
1. Use the Contact Picker for contacts the user chooses
On Android 17, the Contact Picker returns only the fields you ask for, for the contacts the user selects, without any permission. For apps targeting API 37+, the system also upgrades the legacy Intent.ACTION_PICK to the new picker.
val pickContact = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
val uri = result.data?.data ?: return@registerForActivityResult
// read the fields the user shared from this Uri
}
val intent = Intent(ACTION_PICK_CONTACTS).apply {
putStringArrayListExtra(
EXTRA_PICK_CONTACTS_REQUESTED_DATA_FIELDS,
arrayListOf(ContactsContract.CommonDataKinds.Phone.CONTENT_ITEM_TYPE)
)
}
pickContact.launch(intent)2. Remove READ_CONTACTS, including from libraries
<uses-permission android:name="android.permission.READ_CONTACTS" tools:node="remove" />3. If the app really needs the whole address book
Keep the permission and complete the Contacts declaration in Play Console: which user-facing feature needs it, and why the Contact Picker is not enough.
Check before you submit
Upload the APK, AAB or split-APK set (XAPK, APKS, APKM) on the store check page. It runs PLAY-CONTACTS-PERMISSION against the dates on this page, then deletes the file: nothing about the app is kept.
FAQ
My app targets API 36. Is it concerned on January 27, 2027?
Not by this rule: it applies to apps that target API 37 or higher. The store check reports it as not applicable and says so. It will apply when you raise the target API.
Does WRITE_CONTACTS count?
Google's text names READ_CONTACTS only, so the store check flags READ_CONTACTS only.