The short version
Google Play has started flagging Android apps whose contacts and precise-location requests go beyond what its new policies allow, months before the rules are enforced. Apps targeting Android 17 must use the system Contact Picker instead of reading the whole address book and a one-tap location button for one-off location tasks. For teams running Android app development on an existing product, the October 27 checks are the first point where a non-compliant update gets a warning in Play Console.
What did Google change in Play policy?
Google announced the changes on April 15, 2026, in a post by Group Product Manager Bennet Manuel. A new Contacts Permissions policy makes the Android Contact Picker the default way to get contact data for invites, sharing or one-time lookups. Apps targeting Android 17 may request READ_CONTACTS only when the picker cannot support core functionality, and must then justify that need in a Play Developer Declaration. In Google's words, broad contact access "will be reserved for apps that can't function without it."
The updated Location Permissions policy introduces the location button as the minimum scope for precise location. When an app needs a precise fix only for a discrete, user-initiated action, such as finding a nearby store or tagging a photo, it must add the onlyForLocationButton flag in its manifest and use the button rather than a standing fine-location grant. Apps that genuinely need persistent precise location file a declaration showing why the button or coarse location is not enough. The same policy round also removed geofencing as an approved foreground-service use case, pointing developers to the Geofence API.
What do the October 27 pre-review checks do?
Google's timeline set October 27, 2026 as the start of pre-review checks in Play Console that identify potential contacts or location permission issues before an update goes to review. Alongside them, Play policy insights in Android Studio are meant to tell developers inside the IDE whether an app should switch to the new picker or button. The checks are a warning layer: Google's policy preview lists January 27, 2027 as the date the two requirements take effect for apps targeting API level 37.
That gap matters because Play's target API level rules move every year. Once a team raises its targetSdkVersion to 37, which Google Play will eventually require for updates, the app falls under both policies, and an address-book or fine-location request without a valid declaration becomes a review risk rather than a nice-to-fix.
How do the Contact Picker and location button work?
The Contact Picker is a system UI that lets the user choose specific contacts, and only the requested fields, instead of granting an app the entire address book. Access is scoped to what the user selected. The location button is a system control that hands an app a precise location for the current session after a single tap and then expires, so a store-finder or check-in feature no longer needs a permanent fine-location permission.
| Use case | Expected approach for apps targeting Android 17 |
|---|---|
| Invite friends, share with a contact, one-time lookup | Android Contact Picker or Sharesheet; remove READ_CONTACTS |
| Full, ongoing contact sync (e.g. dialer, CRM, messenger) | READ_CONTACTS plus a Play Console declaration |
| Find nearby, tag a post, fill an address once | Location button with onlyForLocationButton |
| Navigation, delivery tracking, fitness routes | Persistent precise location plus a declaration |
| Geofence-triggered work in a foreground service | Geofence API instead of a foreground service |
Privacy researchers have noted that Apple gave iOS users similar limited-contacts controls in iOS 18, so Google is closing a gap rather than opening a new front. For cross-platform teams this is useful: one product decision about "which contacts do we really need" can now be implemented the same way on both stores.
What it means for US & EU software teams
For product owners, the main risk is not the code change but the inventory. Many apps request contacts or fine location because an early version needed it once, or because an SDK for referrals, analytics or ads pulled the permission into the merged manifest. Those requests now need a reason Google accepts, and the October 27 checks will surface them on the next upload. Auditing the merged manifest, including third-party libraries, is the fastest way to see where an app stands.
For EU-facing products the policy lines up with GDPR data minimisation: collecting two selected contacts instead of a full address book shrinks the personal data an app processes, stores and must protect, and simplifies the records of processing a privacy team maintains. In the US, the same reduction lowers exposure under state privacy laws. Teams in logistics, retail and social apps, where location and invites drive core flows, should treat the declaration text as product documentation: it has to match what the app visibly does.
The budget question is timing. Adopting the picker and location button is typically a contained change, but it touches onboarding, referral and checkout flows that are tested end to end. Doing it in the current release cycle, while Play only warns, is cheaper than doing it under a rejected-update deadline in early 2027.
Checklist for Android teams
- Audit the merged manifest. List every
READ_CONTACTS,ACCESS_FINE_LOCATIONand foreground-service type, including those added by SDKs. - Map each permission to a feature. Decide whether the feature needs ongoing access or a one-time user action.
- Switch one-time flows. Move invites and sharing to the Contact Picker or Sharesheet and one-off location tasks to the location button.
- Prepare declarations. For apps that truly need full contacts or persistent precise location, write the Play Console declaration and keep in-app disclosure consistent with it.
- Upload a test build. Push an internal-track build to see what the new pre-review checks report before the next production release.
- Plan the API 37 bump. Schedule the
targetSdkVersion37 upgrade together with these changes so they are tested once.
Frequently asked questions
What changes in Google Play on October 27, 2026?
Google Play Console starts running pre-review checks that flag potential problems with the new Contacts Permissions policy and the updated Location Permissions policy before an app update is submitted. Google announced the checks on April 15, 2026, together with the policies themselves.
Which apps are affected by the Contacts Permissions policy?
Apps that target Android 17 (API level 37) or higher. They may request READ_CONTACTS only if the Android Contact Picker is not sufficient for core functionality, and must then submit a declaration in Play Console explaining why. Apps that use contacts for sharing or inviting should switch to the Contact Picker or Sharesheet and remove READ_CONTACTS.
What is the Android location button and when is it required?
The location button is an Android 17 system control that grants precise location for a single session after one tap. For apps targeting Android 17 or higher that need precise location only for a one-time, user-initiated action, such as finding a nearby store or tagging a photo, Google Play requires the location button, enabled with the onlyForLocationButton manifest flag, instead of a persistent precise-location permission.
When do the new Play policies become mandatory?
Google's policy preview page lists January 27, 2027 as the effective date for both the Contacts Permissions and Location Permissions requirements for apps targeting API level 37 or higher. The October 27, 2026 pre-review checks are an early warning so teams can fix issues before enforcement.
Sources
Android Developers Blog — Boosting user privacy and business protection with updated Play policies (April 15, 2026)
Play Console Help — Preview: Permissions and APIs that Access Sensitive Information
Play Console Help — Policy announcement: April 15, 2026
Help Net Security — Google Play is changing how Android apps access your contacts and location (April 16, 2026)
Malwarebytes — Android 17 ends all-or-nothing access to your contacts (April 21, 2026)