Google Play's New Permission Checks Put a 30-Day Clock on Client Apps

On October 29, 2026, Google published a Play Console policy announcement that tightens how Android apps are allowed to request a user's contacts and location. Independent coverage from Vioside confirmed the same core change: the update adds pre-review checks in the Play Console that flag likely contact or location permission violations before an app is ever submitted for human review. Developers have at least 30 days from the announcement date to bring an existing app into compliance.

None of this is a brand-facing change. It will not show up in a press release or a feature announcement. But for any firm that owns or maintains an Android app for a client — a booking tool, a loyalty app, a field-service dashboard — it is a compliance deadline with a real enforcement mechanism behind it, and it lands on a part of the app most marketing teams never touch.

What Actually Changed

The policy narrows two permission categories. For contacts, apps are now expected to use the Contact Picker or a Sharesheet-based flow as the default way to let a user share a contact, reserving broad READ_CONTACTS access for apps that genuinely cannot function without it. For location, apps built against newer Android targets must use the one-time location button for occasional location needs, and any app requesting ACCESS_FINE_LOCATION now has to file a Play Console declaration justifying why a coarser option will not work.

The pre-review checks are the part that changes the day-to-day risk. Previously, an overly broad permission request might slip through initial review and only get flagged later, sometimes after the app was already live and generating revenue. Now the Play Console itself surfaces the issue before submission, which means a client app built two or three years ago — back when broader permission scopes were routine — is far more likely to get stopped at the next update it ships.

Why This Lands on the Agency, Not the Client

A client who commissioned an Android app rarely knows what permissions it requests under the hood, and has no way to tell whether its contact or location access still matches current policy. That knowledge sits with whoever last touched the codebase. If that was an in-house hire who has since left, or a freelancer engaged for a single build years ago, the firm now has a compliance clock running with nobody actively watching it.

• Audit existing permission requests — check whether the app's current contact and location access matches what its actual features need, not what was convenient to request at build time.
• Confirm location targeting — apps still targeting older Android API levels are not yet forced into the one-time location button, but that exemption narrows every release cycle.
• Treat the 30-day window as real — Play Console pre-review checks do not negotiate; an app that fails the check does not reach a human reviewer to argue the case.

This kind of policy maintenance is exactly the gap a dedicated Android development team is built to close: someone whose job includes watching for platform policy changes and updating a client's app before a rejected build becomes a missed deadline, rather than reacting to it after the fact.

The Pattern Behind the Update

This is the second Play Store privacy tightening this year that touches contacts and location data, and it will not be the last. Google has made clear that permission scope creep — apps asking for more access than their core function requires — is a standing enforcement priority, not a one-time cleanup. Firms that treat a client's Android app as a finished deliverable rather than a maintained asset will keep getting caught by policy updates they never saw coming.

If your firm maintains an Android app for a client and nobody has checked its permission requests against this update, that is worth doing before the 30-day window closes. If the audit turns up more than a quick fix, book a free consultation and we can help you scope what needs to change.