Google Play contacts permission policy and the Android Contact Picker

Who is concerned

Apps that read the user’s contact list, for example for invites, messaging, calling or sync features.

Apps that add or edit contacts are concerned by the August 25, 2027 rule on the Manage Contacts permission.

What changes

• Broad access to users’ contacts is restricted. If broad access is not required for core functionality, use the Android Contact Picker, which Google describes as a more secure, easy-to-integrate alternative that minimizes data collection.
• Apps targeting Android 17 or higher (API level 37+) may request READ_CONTACTS only if the Contact Picker is not sufficient for core functionality. Apps that still request it must submit a Play Console declaration that shows why.
• Contacts are personal and sensitive data under the User Data policy. Apps may not disclose or publish non-public contacts data unless the contacts themselves authorized it.
• August 25, 2027: the Manage Contacts permission (MANAGE_CONTACTS) is restricted to core functionality when system pickers are insufficient. Apps targeting Android 18 or higher (API level 38+) must submit a declaration to use it, and other apps must use narrowly scoped platform intents such as ACTION_INSERT and ACTION_EDIT.

What to do

• Find every use of READ_CONTACTS and ask whether a one-time pick of a contact is enough.
• Move those flows to the Android Contact Picker, which Google’s Android 17 feature page describes.
• If you keep READ_CONTACTS, write the declaration: the access need and why the picker would not suffice.
• Check that contacts data is never disclosed or published without the contact’s authorization.

What happens after the date

The date comes from Google’s Policy Deadlines table, which lists the Contacts Permissions policy as announced on April 15, 2026. Google introduced the policy to govern broad access to users’ contacts.