Skip to content
Narvy

READ_CALL_LOG no longer allowed for account verification by phone call

Apps that read the call log to confirm a phone number (a verification call the app detects) lose that permitted use. Google points to the Digital Credentials API, directly or through a verification provider built on it, or the SMS Retriever API, neither of which needs a call log permission.

What it means

Our SMS and Call Log Permissions policy will no longer permit account verification via phone call as a use case for the READ_CALL_LOG permission.

Play Console Help, SMS or Call Log permission groups (preview)

READ_CALL_LOG stays allowed for default Phone or Assistant handlers and for the exceptions Google lists, with the existing SMS and Call Log declaration. The store check reports apps that request READ_CALL_LOG as not determined: why the app reads the call log is not in the binary.

Deadline

From January 27, 2027, as listed in Google's Play policy deadlines. The store check applies the rule from that date; before it, the finding is titled "Required from" the date. It is never a blocker: what Google requires is not in the binary.

How to fix it

1. Replace the verification flow

Verify the phone number with the Digital Credentials API, or with a one-time code read through the SMS Retriever API.

2. Remove READ_CALL_LOG if nothing else needs it

AndroidManifest.xml (xmlns:tools="http://schemas.android.com/tools")
<uses-permission android:name="android.permission.READ_CALL_LOG" tools:node="remove" />

3. Other uses: keep the declaration up to date

If the app is a default dialer or falls under a listed exception, keep the permission and update the SMS and Call Log declaration so it no longer mentions account verification.

Check before you submit

Upload the APK, AAB or split-APK set (XAPK, APKS, APKM) on the store check page. It runs PLAY-CALL-LOG-VERIFICATION against the dates on this page, then deletes the file: nothing about the app is kept.

Check a build in the browser

FAQ

Does this change the SMS permissions?

This change names READ_CALL_LOG and account verification by phone call only. The rest of the SMS and Call Log policy is unchanged.

A verification SDK in the app requests READ_CALL_LOG. Is the app concerned?

Yes, Google reviews the merged manifest, which includes the permissions of every dependency. Check whether the SDK offers a flow without call log access, then remove the permission.