Guide · 7 min read
Google Play Permissions Policy 2026: Contact Picker, Location Button, and AI Disclosure Requirements
Google Play's October 28, 2026 enforcement deadline is closer than most indie developers realize, and it covers three distinct changes: how your app accesses contacts, how it requests location, and how it discloses AI-generated content. Unlike the August 31 Android API 36 target SDK deadline, these aren't build-tool upgrades — they require code changes, Play Console declarations, and in-app UI updates. This guide covers exactly what to change and what happens if you wait.
October 28, 2026: the enforcement deadline covering all Android 17+ apps
Three distinct policy changes hit enforcement on October 28, 2026: the contacts permission overhaul, the location button minimum-scope requirement, and the AI-generated content disclosure mandate. All three apply to apps targeting Android 17 (API level 37 and above). If your app reads contacts, requests persistent location access, or surfaces any AI-generated output to users, this date matters.
Google announced the contacts and location changes in its April 15, 2026 Android Developers Blog post, giving developers a 30-day soft window before the October hard deadline. After October 28, apps in scope that haven't updated face update blocks, new submission rejections, and eventual removal from the Play Store. The window is open but closing.
If you're already preparing your app for the Android API 36 target SDK deadline on August 31, 2026 — which requires a new build submission for all existing apps — bundle the contacts and location changes into that same release. The compliance windows nearly align, and combining them avoids a second submission cycle two months later.
Contact picker requirement: READ_CONTACTS now requires a justification declaration
Apps targeting Android 17 (API level 37+) may only request READ_CONTACTS if the Android Contact Picker cannot fulfill the app's core functionality. The Android Contact Picker is a system UI that lets users choose specific contacts to share with your app — no permission dialog, no privacy declaration required, no data-collection risk. For the majority of apps that use contacts, the picker handles the entire use case without READ_CONTACTS.
The picker covers: pre-filling a recipient field, inviting friends from a contact list, auto-completing an address, or reading selected contact details one at a time. The picker cannot cover: server-side sync of the full address book, searching across all contacts without user interaction per contact, background contact processing, or CRM-style access that operates on the full contact database in real time. If your use case falls into the first category, migration is straightforward. If it falls into the second, you need a Play Console declaration.
Third-party libraries are not exempt from this policy. If a library your app imports declares READ_CONTACTS in its Android manifest, your app is in scope regardless of whether your own code touches the permission. Several popular React Native and Flutter contacts libraries were flagged non-compliant after the April announcement — check your dependency tree before assuming you're clear.
How to migrate to the Android Contact Picker — and the declaration fallback
Migrating to the Android Contact Picker takes most apps one afternoon of engineering work. Replace your READ_CONTACTS request with an Intent using action ACTION_PICK targeted at the Contacts Contract. The system presents its own picker UI; when the user selects a contact, your app receives a result URI. Read only the fields you need from that URI — no broad access, no manifest permission change required.
The main behavioral difference from READ_CONTACTS: the user chooses each contact explicitly rather than granting your app access to iterate the full list. If your UX depended on letting users browse and filter their entire contact list inside your app's own interface, that flow requires redesign — you can no longer pull the full list without a declaration. Most apps don't need that capability; those that do are typically enterprise tools with a defensible core-functionality argument.
If your app genuinely cannot migrate, file a Play Console declaration under App Content → Sensitive Permissions before October 28 explaining what data you access, why the picker is technically insufficient, and how the data is stored and protected. Declaration reviews have taken 5–14 business days based on developer community reports. Submit early — the October deadline does not pause for a pending review cycle.
Location button: the minimum-scope default Google now enforces
The Android location button is the system element for one-time, user-initiated location requests — the minimum-scope default that Google now requires for most location use cases. Tap the button, the system shares location once, then reverts to no access. No persistent permission dialog, no Always On access granted, no ongoing tracking unless the user taps again.
The location button is correct for: 'search nearby' queries, tagging a post with a current location, auto-filling a delivery address, or any feature where location is a single-point input triggered by the user in the moment. It is not the right tool for navigation apps that need continuous tracking, delivery tracking with background updates, geofencing triggers, or any feature that needs location when the user isn't actively in your app.
Apps that need persistent precise location can still request it — but Google's October 28 enforcement sets the expectation that you start with the location button and escalate only when core functionality demonstrably requires more. Requests for persistent precise location that the button could handle adequately will face increased scrutiny in policy reviews. If you also ship an iOS version, this mirrors what Apple has required since iOS 14 — the minimum-scope logic is the same on both platforms.
AI-generated content disclosure: what to label and where inside your app
Google Play's July 2026 AI disclosure policy requires visible labeling whenever users encounter AI-generated content inside your app — chat responses, generated images, AI summaries, voice outputs, or AI avatars. The disclosure must appear in the app interface itself, not deferred to a privacy policy, settings page, or one-time onboarding consent users dismiss on first launch.
Visible labeling in practice means: a label adjacent to each AI-generated chat message ('AI-generated' or an AI indicator icon), a caption on generated images, a disclosure near the top of AI-generated summaries. The standard is 'clear to a reasonable user', not 'technically present somewhere in the app'. For a full breakdown of what to label in both the app UI and Play Store listing, see the AI content disclosure guide for app stores.
Deepfakes, realistic synthetic voices that impersonate real people, and misleading AI representations face stricter enforcement under a separate provision — these are violations, not a disclosure opportunity. The July 2026 policy applies to legitimate AI features your users interact with. If the AI output itself violates content policy, labeling it doesn't exempt it from removal.
Play Console declarations and compliance checks before the deadline
Two categories of apps need to submit Play Console declarations before October 28. First: apps that request READ_CONTACTS with a core-functionality justification for why the Android Contact Picker is insufficient — file this under App Content → Sensitive Permissions. Second: apps requesting persistent foreground or background location access for features the location button could technically handle — the justification bar here is high and Google will apply close scrutiny. AI content disclosures require no formal Play Console submission; compliance is evaluated against what users see inside the app during policy review.
If your app uses third-party SDKs that are themselves non-compliant, check the SDK Index in Play Console under Policy Status. Google surfaces flagged SDKs before they trigger enforcement against your app. Running the SDK Index audit before submission catches dependency-level problems without a rejection. The billing flexibility changes that rolled out earlier in 2026 similarly required no formal declaration — only implementation compliance — and Play Console was the correct place to verify status.
While you're in Play Console, confirm that your Play Store feature graphic meets the required 1024×500 pixel specification and that your screenshots reflect the current app UI — submissions that fail pre-checks on multiple fronts take longer to clear policy review. Updating your asset set alongside your compliance release is efficient use of the review window.
Act before the October deadline — update blocks are real
The October 28 enforcement deadline carries genuine risk: update blocks prevent you from shipping new versions, and removal from Play Store search follows the warning period. Bundle your compliance changes into the August API 36 submission if you haven't already moved, and file any Play Console declarations with enough lead time for a review cycle before the hard date.
If you're refreshing your Play Store listing alongside these compliance changes — new screenshots, updated feature graphic, revised metadata — the AppsTemple editor exports to every required Play Store asset dimension.
Export Play Store assets in the editor →
Frequently asked questions
does the google play contact picker requirement apply to existing apps or only new submissions
It applies to all apps that target Android 17 (API level 37+), including existing apps that update their target SDK. Since Google requires all apps to update to API 36 by August 31, 2026, and API 37 is the next version, apps keeping their target SDK current will come into scope on their next update cycle. Apps that remain on lower target SDK levels are temporarily out of scope but will be affected as Google raises the minimum floor over time.
what happens if my app is not compliant by october 28 2026
After October 28, non-compliant apps targeting Android 17+ cannot publish updates to the Play Store — update blocks are the first enforcement action. New submissions in scope will be rejected at review. Apps already live may receive a policy warning with a short cure period before removal from search and browse results. The app remains installable for users who already have it during the warning period, but no new users can discover it through the store.
can react native and flutter apps use the android contact picker
Yes — both React Native and Flutter can integrate the Android Contact Picker through native bridge calls or existing packages. The complication is that several popular contact libraries were flagged as non-compliant after the April 2026 announcement and are actively being updated by their maintainers. Check the GitHub issues page for the contacts library you use. If the library isn't yet updated before your deadline, implement the Contact Picker directly using a native module or a Flutter platform channel — the underlying Android API is stable and straightforward.
do i need to disclose ai content that users never see directly, like ai used for ranking or recommendations
No. The disclosure requirement applies to AI-generated content that users see and interact with — chat responses, generated text or images, AI avatars, synthetic audio. AI used for internal ranking, recommendation logic, classification, or personalization that doesn't produce visible output to users is not in scope. The test is simple: does the user encounter content that was generated by AI? If yes, label it. If AI is behind-the-scenes infrastructure, no in-app disclosure is required under the July 2026 policy.
what justification is strong enough to keep read_contacts permission under the new policy
Google's bar is core functionality — the app's primary defining feature cannot work with the Contact Picker. Strong justifications: an email or messaging app that syncs the full contact database server-side for search and autocomplete across all contacts; a CRM where searching and enriching the full contact list is the main feature; a contacts management app that reads and writes across all contacts by design. Weak justifications that will be rejected: 'we use contacts to personalize content', 'we let users invite friends' (the picker handles this), or 'it's a better UX than the system picker'. If your argument is convenience, expect the declaration to be denied.