What it means
Apps that target Android 13 or later (API level 33+) may only request the READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions if system pickers (like the Android Photo Picker) are not sufficient for your app to provide core functionality.
Permissions and APIs that access sensitive information
Google Play treats READ_MEDIA_IMAGES, READ_MEDIA_VIDEO as access to sensitive data or capabilities. An app that requests it must qualify for an allowed use and say so in a declaration in Play Console; Google can reject an update, or remove the app, when the use is not declared or not allowed. It is allowed when the core feature needs broad, persistent access to the photo library (gallery, photo editing or backup apps), which a one-time picker cannot provide.
Rejections for this policy arrive as Play Console policy messages whose wording varies, so this page quotes the policy itself rather than one message.
Deadline
No upcoming date is recorded by the store check: the policy is in force, and the declaration is checked at review.
How to fix it
1. Check whether your app qualifies
The permission is allowed when the core feature needs broad, persistent access to the photo library (gallery, photo editing or backup apps), which a one-time picker cannot provide. If that is not your app's core feature, do not declare it: remove it.
2. If it qualifies: fill in the declaration
In Play Console, open Policy, then App content, and complete the declaration for this permission: the feature that needs it, why no alternative works, and, when Play Console asks for it, a short video of the feature.
3. Otherwise: remove it, including from libraries
Use the Android Photo Picker, which needs no permission. If a dependency adds the permission, remove it from the merged manifest:
<uses-permission android:name="android.permission.READ_MEDIA_IMAGES" tools:node="remove" />
<uses-permission android:name="android.permission.READ_MEDIA_VIDEO" tools:node="remove" />Check before you submit
Upload the APK, AAB or split-APK set (XAPK, APKS, APKM) on the store check page. It runs PLAY-PERMISSION-DECLARATION against the dates on this page, then deletes the file: nothing about the app is kept. The same engine runs offline in the Narvy CLI, and exits with code 1 when a blocker is found, so it can gate a CI job.
narvy store-check app-release.aabFAQ
A library added this permission. Is my app concerned?
Yes. Google reviews the uploaded build, and its merged manifest includes the permissions of every dependency. Remove it with tools:node="remove" if the app does not need it.
Does the store check tell me whether my use is allowed?
No. It detects the permission in the build and tells you a declaration is needed. Whether the use qualifies is Google's review decision.