Use of All files access (MANAGE_EXTERNAL_STORAGE) permission

Due to COVID-19 related considerations, apps that target Android 11 (API level 30) and request All files access cannot be uploaded to Google Play until early 2021. This includes new apps as well as updates to existing apps. This temporary uploading restriction only affects apps that both target Android 11 (API level 30) and request the All files access permission.

For now, if you think All files access is needed for your app, it is recommended that you don’t update your target SDK level to Android 11 (API level 30) at this time. If you target Android 10, consider using the requestLegacyExternalStorage flag.

Google Play restricts the use of high risk or sensitive permissions, including a special app access called All files access

If your app does not require access to the all files access permission, you must remove it from your app's manifest in order to successfully publish your app. Details on policy-compliant alternative implementations are also detailed below.

If your app meets the policy requirements for acceptable use or is eligible for an exception, you will be required to declare this and any other high risk permissions using the Declaration Form in the Play Console.

Apps that fail to meet policy requirements or do not submit a Declaration Form may be removed from Google Play.

When should you request the All files access permission?

You should only access the all files access permission when your app can not effectively make use of the more privacy friendly best practices, such as using the Storage Access Framework or the Media Store API

Additionally, the app’s usage of the permission must fall within permitted uses, and must be directly tied to the core functionality of the app. Core functionality is defined as the main purpose of the app. Without this core functionality, the app is "broken" or rendered unusable. The core functionality, as well as any core features that comprise this core functionality, must all be prominently documented and promoted in the app's description. 

Collapse All Expand All

Permitted uses of the all files access permission

For apps requesting access to the all files access permission, intended and permitted use includes; file managers, backup and restore apps, anti-virus apps, and document management apps.

Apps granted access to this permission may not extend its use to undisclosed or invalid purposes.

Use

Eligible permission*

File management

(App’s core purpose involves the access, editing and management of files outside of its app-specific storage space)

MANAGE_EXTERNAL_STORAGE

Backup and restore apps

(App must have a need to automatically access multiple directories outside of its app-specific storage space for the purpose of backup and restore).

MANAGE_EXTERNAL_STORAGE

Anti-virus apps

(App’s core purpose is to scan the device and provide anti-virus security features to the device user)

MANAGE_EXTERNAL_STORAGE

Document management apps

(Apps that must locate, access and edit compatible file types outside of its app-specific or shared storage)

App must justify in their Console declaration why the solutions documented in the Access app-specific files or Storage Access Framework documentation are not sufficient for their purpose.

MANAGE_EXTERNAL_STORAGE


* Subject to Google Play review and approval.

Exceptions

Google Play may provide a temporary exception to apps that do not qualify as permitted use designated above, when;

  1. Use of the permission enables the app’s core functionality; and
  2. There is currently no alternative method to provide the core functionality; or 

use of the privacy friendly alternatives (e.g. MediaStore API, or Storage Access Framework) has a substantially detrimental impact on the critical features of the app that are tied to the core functionality.

  1. The impact on user privacy is mitigated by security and privacy best practices

The developer must justify in their Console declaration why the Storage Access Framework or MediaStore API is not sufficient for their app’s purpose.

Note: Apps for carrier and OEM services may request permissions access for the above use cases, in addition to critical services that require access.

Policy Exception

If you have old APKs with SMS / Call Log permissions and you are no longer able to make code changes to these APKs you may apply for a policy exception.

In order to qualify for the exception, you must meet ALL of the following requirements:

  • You must declare the specific APK(s) for which you would like an exception

  • The APKs requesting an exception must have been published before 1st January 2019

  • You must have alternative APKs served to users on Android 10 (API Level 29) or higher, and these must be compliant with the access all files (MANAGE_EXTERNAL_STORAGE) permissions policy requirements

  • The APKs requesting an exception must represent a very small percentage (no more than low single-digit %) of your total install base

  • The APKs requesting an exception must not present a security or privacy vulnerability to users and may not provide file data to third parties

Google Play will review the request and grant exceptions on a case by case basis. Alternatively, you may choose to unpublish the violating APKs to be compliant with the all files access permissions policy. Please also be advised that apps eligible for this policy exception are still subject to, and may be impacted by, Store-wide policy efforts like Google Play’s Target API Level requirements.

Invalid uses

In some cases, apps may wish to access sensitive user data for purposes where a safer and more secure alternative exists, or where risk of data exposure doesn't warrant access. 

Below is a list of common use cases that won't be permitted to request the MANAGE_EXTERNAL_STORAGE permission 

  • Media Files access (see Alternatives below)
  • Any File selection activity where the user manually selects individual files (see Alternatives below)

Note: This list is not exhaustive. For in depth guidance, please refer to the All Files Access documentation and Scoped Storage best practices guidance for developers.

Alternatives to common uses

Use

Alternatives

Access of Media Files

With the MediaStore API, apps can contribute and access media that’s available on an external storage volume without the need for the access all files permission.

User selects files for importing/transferring/processing

There are multiple, more privacy friendly options for accessing files in shared storage, including using the Storage Access Framework and system file picker.

Important: If you change how your app uses these restricted permissions, you must submit the form again with updated and accurate information. Deceptive and non-declared uses of these permissions may result in a suspension of your app and/or termination of your developer account.

Was this helpful?
How can we improve it?