Use of SMS or Call Log permission groups

Google Play restricts the use of high risk or sensitive permissions, including the SMS or Call Log permission groups. 

If your app does not require access to Call Log or SMS permissions, you must remove these permissions from your app's manifest. Details on policy compliant alternative implementation are also detailed below. 

If you believe your app meets the policy requirements for acceptable use or is eligible for an exception, submit a Permissions Declaration Form as soon as possible for Google Play to review. You will be notified if your request has been approved. You do not need to have implemented APK changes in order to submit the Declaration Form.

Apps that fail to meet policy requirements or submit a Permissions Declaration Form by January 9, 2019 may be removed from Google Play.

For apps with Declaration Forms submissions received by Jan 9, 2019, Google Play, at its option, may grant extensions until March 9, 2019 for you to make changes to bring your app(s) into compliance with this Play policy. If you do not plan on using these permissions, but still require additional time to bring your app(s) into compliance, please complete the Declaration Form. 

When should you access these permissions

You should only access Call Log or SMS permissions when your app falls within permitted uses, and only to enable your app’s core functionality. 

Core functionality is defined as the main purpose of the app. It's the feature most prominently documented and promoted in the app’s description; no other feature is more central to the app’s functionality. If this feature isn't provided, the app is “broken” or rendered unusable (i.e., app is deprived of its primary functionality and will not perform as a user would expect).

Collapse All Expand All

Permitted uses of the SMS & Call Log Permissions

For apps requesting access to the SMS or Call Log permissions, the intended and permitted uses include default SMS handling, default phone handling, or Assistant handling capability.

Apps must be actively registered as the default SMS, Phone, or Assistant handler before prompting users to accept any of the above permissions and must immediately stop the use of the permission when they no longer are the default handler. 

Use

Allowed permissions*

Default SMS handler

READ_SMS, SEND_SMS, WRITE_SMS, RECEIVE_SMS, RECEIVE_WAP_PUSH, RECEIVE_MMS

Default Phone handler

READ_CALL_LOG, WRITE_CALL_LOG, PROCESS_OUTGOING_CALLS

SEND_SMS

Default Assistant handler

READ_SMS, SEND_SMS, WRITE_SMS, RECEIVE_SMS, RECEIVE_WAP_PUSH, RECEIVE_MMS

READ_CALL_LOG


*Google Play must approve your Permissions Declaration Form.

Exceptions

Google Play may provide a temporary exception to apps that aren't Default SMS, Phone, or Assistant handlers when:

  • Use of the permission enables the core app functionality listed below; and
  • There is currently no alternative method to provide the core functionality

Use

Allowed permissions*

Backup and restore for users

READ_SMS, RECEIVE_MMS, RECEIVE_SMS, WRITE_SMS

READ_CALL_LOG, WRITE_CALL_LOG

Enterprise archive and device management

READ_SMS, RECEIVE_MMS, RECEIVE_SMS, WRITE_SMS

READ_CALL_LOG, PROCESS_OUTGOING_CALLS, WRITE_CALL_LOG

Caller ID, spam detection, and spam blocking

READ_CALL_LOG, READ_SMS, RECEIVE_MMS, RECEIVE_SMS, SEND_SMS

Connected device companion apps (for example, smartwatch, automotive)

READ_SMS, RECEIVE_MMS, RECEIVE_SMS, SEND_SMS, WRITE_SMS

PROCESS_OUTGOING_CALLS, READ_CALL_LOG, WRITE_CALL_LOG

Cross-device synchronization or transfer of SMS or calls

READ_SMS, RECEIVE_MMS, RECEIVE_SMS

READ_CALL_LOG

SMS-based financial transactions (e.g., 5 digit messages), and related activity including OTP account verification for financial transactions and fraud detection 

READ_SMS, RECEIVE_SMS, SEND_SMS

Track, budget, manage SMS-based financial transactions (e.g., 5 digit messages) and related account verification 

READ_SMS, RECEIVE_SMS

Task automation

RECEIVE_SMS, SEND_SMS


READ_CALL_LOG, WRITE_CALL_LOG, PROCESS_OUTGOING_CALLS

Proxy calls 

PROCESS_OUTGOING_CALLS, READ_CALL_LOG, WRITE_CALL_LOG


*Google Play must approve your Permissions Declaration Form.

Invalid uses

In some cases, apps may wish to access sensitive user data for purposes where a safer and more secure alternative exists, or where risk of data exposure doesn't warrant access. 

Below is a list of common use cases that won't be permitted to access sensitive user data associated with SMS and Call Log permissions: 

  • Account verification (see Alternatives below)
  • Content sharing or invites (see Alternatives below)
  • Contact prioritization, affinity profiles, show recently called/messaged, or social graphs

Note: This list is not exhaustive.

Alternatives to common uses

Use

Alternatives

OTP & account verification

With the SMS Retriever API, you can perform SMS-based user verification in your app automatically, without requiring the user to manually type verification codes, and without requiring any extra app permissions.

If the SMS Retriever API is not an option for your app, users can also manually enter a verification code.

Initiate a text message

With the SMS Intent, your apps can initiate an SMS or MMS text message.

Share content

With the Share Intent, your app can enable users to share content or send invites through a variety of supporting apps without requiring sensitive app permissions.

Initiate a phone call

With the Dial Intent, your app can specify a phone number and open the phone app. The user can then explicitly initiate the phone call.

The Dial Intent doesn't require the CALL_PHONE permission.

 

Important: If your app's usage of these restricted permissions changes, you must submit the form again with updated and accurate information. Deceptive and non-declared uses of these permissions may result in a suspension of your app and/or termination of your developer account.

Was this article helpful?
How can we improve it?