To help protect users and their data, Google Play restricts the use of high risk or sensitive permissions, including SMS or Call log permission groups.
If your app doesn't qualify for access to call log or SMS permissions, you must remove these permissions from your app's manifest. This article includes details about policy-compliant alternatives.
If you believe that your app meets the policy requirements for acceptable use or is eligible for an exception, you must declare any call log or SMS permissions directly through Google Play Console.
Apps that fail to meet policy requirements or lack a Permissions Declaration Form may be removed from Google Play.
When to access these permissions
Only access call log or SMS permissions when your app falls within permitted uses and only to enable your app’s critical core functionality.
Think of core functionality as the main purpose of your app. You may have one core feature or a set of them. Without which, the app is broken or rendered unusable. Make sure that your app’s description prominently documents and promotes its core feature(s).
Permitted uses of the SMS and call log permissionsFor apps requesting access to the SMS or call log permissions, the intended and permitted uses include default SMS handling, default phone handling or Assistant handling capability.
Apps must be actively registered as the default SMS, Phone or Assistant handler before prompting users to accept any SMS or call log permissions. Those apps must immediately stop using the permission when they're no longer the default handler.
For apps that are actively set as the default handler, approved core functionality may include contact prioritisation that presents the user with their most important contacts or improves recognition and understanding of names. Contact prioritisation may use contact recency, frequency and duration as part of enabling individual user-initiated calls, texts and actions. Uses beyond contact prioritisation, including using data from one user to directly influence another user's product experiences, are disallowed.
|
Use |
Eligible permissions* |
Example of permitted use |
| Default SMS handler (when app is the registered default handler for SMS and any other core functionality usage) |
|
A user relies on a default SMS app to receive and send SMS messages. |
| Default Phone handler (when app is the registered default handler for phone and any other core functionality usage) |
|
A user often places international phone calls, so they set this app as the default dialler to avoid higher phone operator rates. |
| Default Assistant handler (when app is the registered default handler for Assistant and any other core functionality usage) |
|
A user uses this app to receive, translate and reply to SMS conversations in real time in someone else’s native language. |
* Subject to Google Play review and approval.
Google Play may provide a temporary exception to apps that aren't Default SMS, Phone or Assistant handlers when:
- Use of the permission enables the core app functionality listed in the following table and
- there's currently no alternative method to provide the core functionality.
|
Use |
Eligible permissions1 |
|
Account verification via phone call Device may be verified by transmitting a phone call; receipt of a phone call is confirmed by verifying the number in a call log |
READ_CALL_LOG |
|
Anti-SMS phishing ('smishing') You must have a track record of significant protection for users – as reflected in analyst reports, benchmark test results, industry publications and other credible sources of information – to be eligible for implementing this use case. |
READ_SMS, RECEIVE_MMS, RECEIVE_SMS, RECEIVE_WAP_PUSH, WRITE_SMS |
|
Backup and restore for users User content backup, restore and cloud storage |
|
|
Caller ID, spam detection and/or spam blocking |
|
|
Connected device companion apps that enable sending/receiving of SMS or calls Apps that enable the user to connect a mobile device to a connected device (for example, a smartwatch, automotive technology, smart home device, etc.) and send/receive texts and phone calls |
|
|
Cross-device synchronisation or transfer of SMS or calls Apps that enable the user to sync texts and phone calls across multiple devices (such as between phone and laptop) |
|
|
Device automation Apps that enable the user to automate repetitive actions across multiple areas of the OS, based on one or more conditions (triggers) set by the user |
|
|
Enterprise archive, business and enterprise customer relationship management (CRM) and/or enterprise device management Device management for corporate entities for their employees; corporate login required for access * For CRM use: only permissions marked with * are allowed |
|
|
In-vehicle hands-free use and projected display Apps whose core functionality (like navigation), directly relates to driving/mobility, especially in situations where a user’s physical interactions with a device(s) are limited |
|
|
Physical safety/emergency alerts to send SMS Apps that send SMS alerts in emergency situations |
SEND_SMS |
|
Proxy calls Apps that provide an intermediary number to enable user calls/texts |
PROCESS_OUTGOING_CALLS, READ_CALL_LOG, WRITE_CALL_LOG |
|
SMS Mobile Broadcast Apps that use cell broadcast messaging for customer communications |
RECEIVE_SMS |
|
SMS-based financial transactions For example, Unified Payments Interface (UPI), verifications for financial transactions |
READ_SMS, RECEIVE_MMS, RECEIVE_SMS, RECEIVE_WAP_PUSH, SEND_SMS |
|
Call-based authentication and authorisation in banking or brokerage apps Banking or brokerage apps that facilitate secure device-based financial transactions for their service |
READ_CALL_LOG, PROCESS_OUTGOING_CALLS |
|
SMS-based money management For example, apps that track and manage budget |
|
|
Write and show call history in default dialler app Apps that document call history in a user’s dialler |
WRITE_CALL_LOG |
| System services that actively have the SYSTEM_UI_INTELLIGENCE role | READ_SMS, READ_CALL_LOG |
1 Subject to Google Play review and approval.
Policy exception
If you have old APKs with SMS/call log permissions and you're no longer able to make code changes to these APKs, you may apply for a policy exception. Enter the version code(s) separated by commas in the APK exceptions field of the Permissions Declaration Form.
To qualify for an exception, you must meet all of the following requirements:
-
You must declare the specific APK(s) for which you'd like an exception.
-
Your APK(s) must have been published before 1 January 2019 to be granted an exception.
-
You must have alternative APKs served to users on Android Oreo (API level 26) or higher, and these must be compliant with the Permissions policy.
-
The APKs requesting an exception must represent a very small percentage (no more than a low single-digit percentage) of your total install base.
In some cases, apps may wish to access sensitive user data for purposes where a safer and more secure alternative exists, or where risk of data exposure doesn't warrant access.
Below is a list of common use cases that won't be permitted to access sensitive user data associated with SMS and call log permissions:
- Account verification via SMS (see Alternatives below)
- Content sharing or invites (see Alternatives below)
- Contact prioritisation (when not default handler)
- Social graph and personality profiling
- Call recorder
- Device performance booster, space or data management
- Family or device locator
- Smart or predictive keyboard
- SMS or calls appearing in wallpaper, Launcher and other tools
- SMS translation (when not the default handler)
- Text to voice, speech/voice to text (when not default handler or eligible exception)
- SMS and contacts management (when not default handler or eligible exception)
- SMS or phone notification enhancement and Alerts (when not default handler)
- Research (e.g. market research based on SMS)
- Remote control of user phone or other devices
- Any transfer that results in a sale of this data (including SDKs that sell this data)
Note: This list is not exhaustive.
|
Use |
Alternatives |
|
SMS OTP & account verification |
With the SMS Retriever API, you can perform SMS-based user verification in your app automatically, without requiring the user to manually type verification codes and without requiring any extra app permissions. If the SMS Retriever API isn't an option for your app, users can also manually enter a verification code. |
|
Initiate a text message |
With the SMS Intent, your apps can initiate an SMS or MMS text message. |
|
Share content |
With the Share Intent, your app can enable users to share content or send invitations through a variety of supporting apps without requiring sensitive app permissions. |
|
Initiate a phone call |
With the Dial Intent, your app can specify a phone number and open the phone app. The user can then explicitly initiate the phone call. The Dial Intent doesn't require the |
Important: If you change the way that your app uses these restricted permissions, you must submit the Permissions Declaration Form again with updated and accurate information. Deceptive and non-declared uses of permissions may result in a suspension of your app and/or termination of your developer account.