Google Play's April 2026 Permission Changes: Contacts, Location, Foreground Services

Quick answer: On April 15, 2026, Google Play announced a policy update that reshaped how apps may request three common permissions. Apps that need contacts must use the Android Contact Picker instead of broad contacts access. Precise location should default to the least-privilege location button. And geofencing was removed as an approved foreground-service use case, so it must move to the Geofence API. Google set a compliance window of at least 30 days from the announcement. Here is each change, the manifest or API signal behind it, and how to fix it before submitting.

Permission policy updates are easy to miss because they do not change your code on their own. They change what Google Play will accept, and a build that passed last quarter can be rejected this quarter for a permission it has always requested. The April 15, 2026 update is one of those, and it touches permissions that a large share of apps use.

What changed for contacts access?

Apps that need access to a user's contacts must now use the Android Contact Picker, which lets the user choose specific contacts, rather than requesting broad READ_CONTACTS access. Broad contacts access is only acceptable when it is core to the app's purpose and justified.

For most apps, the fix is to drop the runtime contacts permission entirely and call the Contact Picker, which requires no permission at all. That both satisfies the policy and removes a sensitive permission from your manifest.

What changed for location?

Google now points developers to the location button (a one-time, least-privilege share of precise location) as the recommended minimum scope for precise location. Continuous or background location is held to a higher bar and needs a formal declaration that explains why the app requires it.

If your app requests background location but its core feature does not require it, that mismatch is exactly what reviewers look for.

What changed for foreground services?

Geofencing was removed as an approved use case for foreground services. Apps that implemented geofencing through a foreground service must migrate to the Geofence API, which is the supported path. A foreground-service type that no longer maps to an approved use case is a rejection signal.

The permission changes side by side

Permission area	Old approach	New requirement (April 15, 2026)	What to do
Contacts	Request broad READ_CONTACTS	Use the Android Contact Picker unless broad access is core and justified	Replace the permission with the Contact Picker
Precise location	Request precise location up front	Location button (least-privilege) is the recommended minimum	Use the location button; declare background use only if required
Foreground services	Geofencing allowed as a use case	Geofencing removed; use the Geofence API	Migrate geofencing off foreground services

Also in the same update

The April 15, 2026 announcement bundled several other items worth a calendar note: account transfers must use the official Play Console "Transfer ownership" workflow, news and magazine apps had a self-declaration deadline of May 27, 2026, real-money prediction-market apps had to enroll in a pilot by June 1, 2026, and the Health and Fitness policy was updated for Android 16 granular permissions and new high-sensitivity Health Connect data types. If any of those apply to you, check the dates in Play Console.

How to get compliant before submitting (checklist)

1. Open your merged manifest and list every dangerous permission and foreground-service type the build declares.
2. If READ_CONTACTS is present, decide whether contacts are core to the app. If not, replace it with the Contact Picker and remove the permission.
3. If you request precise or background location, confirm the feature genuinely needs it, switch to the location button where possible, and prepare the background-location declaration if you keep it.
4. If you use geofencing, confirm it runs through the Geofence API and not a foreground service.
5. Re-check the Data Safety form so your declared data collection still matches the permissions you actually request. See Data Safety section accuracy.
6. Note the at-least-30-day compliance window from April 15, 2026, and ship the fixes in your next release rather than waiting for a rejection.

Where a pre-submission check helps

These changes are visible in the merged manifest and the foreground-service declarations, which makes them a good fit for a pre-submission scan. A scan can read the permissions and service types your compiled App Bundle actually declares, flag a READ_CONTACTS permission or a geofencing foreground-service type that no longer maps to an approved use case, and let you catch it in CI. For the broader picture, see app permissions and manifest compliance.

Frequently asked questions

Do I have to remove the contacts permission entirely?

Not if broad contacts access is core to your app and you can justify it. For most apps, the cleaner path is to switch to the Android Contact Picker, which needs no permission and satisfies the policy.

Can I still use background location?

Yes, if your app's core feature requires it and you complete the required declaration explaining why. Google now treats the least-privilege location button as the recommended default for precise location.

What replaces geofencing in a foreground service?

The Geofence API. Geofencing was removed as an approved foreground-service use case in the April 15, 2026 update, so geofencing logic should run through the Geofence API instead.

How long did Google give to comply?

Google set a compliance window of at least 30 days from the April 15, 2026 announcement. Treat your next release as the deadline rather than waiting for an enforcement rejection.