Warnings Your Apk Is Using Permissions That Require A Privacy Policy: (android.permission.READ_PHONE_STATE)

Question

In manifest not added android.permission.READ_PHONE_STATE. permission.

Why error comes when I upload a new apk version error comes below.

Your app has an apk with version code 1 that requests the following permission(s): android.permission.READ_PHONE_STATE. Apps using these permissions in an APK are required to have a privacy policy set.

I have attached a screenshot of my google play store account.

my manifest file.

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.my.package.name">

    <uses-permission android:name="android.permission.INTERNET" />

    <application
        android:name=".utils.PreferenceManager"
        android:allowBackup="true"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:largeHeap="true"
        android:supportsRtl="true"
        android:theme="@style/AppTheme">
        <activity
            android:name=".SplashScreen"
            android:screenOrientation="portrait">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <activity
            android:name=".MainActivity"
            android:screenOrientation="portrait" />

        <activity
            android:name=".CategoryListActivity"
            android:screenOrientation="portrait" />
        <activity
            android:name=".ImagesActivity"
            android:screenOrientation="portrait" />

    </application>

</manifest>

Did the permission exist in the manifest before which you have since removed and haven't uploaded the new apk? — aconnelly, Dec 20 '16 at 03:04
I've already tried with adding and again removing. Nothing works — Narendra Sorathiya, Dec 20 '16 at 12:18
Got the same issue with appsflyer which implicitly adds this permission in build phase — Maxim G, Dec 21 '16 at 18:41
I would like to mention that in order to fix this you must update all your dependencies that use the "play-services-" prefix from 12.0.0 to 12.0.1. So that includes anything such as upgrading "play-services-analytics:12.0.0" to "play-services-analytics:12.0.1". It is not just limited to play-services-ads but all play-services with the version 12.0.0. — ChallengeAccepted, May 09 '18 at 23:51
I’m voting to close this question because https://meta.stackoverflow.com/q/272165/6296561 — Zoe, Apr 24 '20 at 16:19

score 153 · Accepted Answer · edited Apr 06 '21 at 11:24

153

Your app's manifest.xml having these permission to access information from your's device but you don't have privacy policy link while submitting on the play store. so you getting this warning.

Need privacy policy for the app If your app handles personal or sensitive user data

Adding a privacy policy to your app's store listing helps provide transparency about how you treat sensitive user and device data.

Update 1

The privacy policy setting in Google Play Console has changed locations.

In Google Play Console,
Select Store presence → App content.
Under Privacy Policy.

Update 2

Select Policy → App content at the far bottom left.
Under Privacy Policy.

edited Apr 06 '21 at 11:24

User Rebo

3,056
25
30

answered Dec 24 '16 at 06:17

Deva

2,386
1
16
16

26

Is there any way to create the private policy from a template? – Daniele Jan 21 '17 at 16:39
1

I hope you'll need to show privacy policy but you don't have website, probably the privacy policy document will be text content, so the easiest way is we can make word document with all your privacy policy and permission related information then you can upload it on any free bucket like drop box etc. then you can get the url to use on the play store submission. – Deva May 26 '17 at 01:38
I am facing the same problem. i didn't use READ_PHONE_STATE permission then why it says that your app use this? – Jaydip Kalkani Mar 27 '18 at 15:35
3

Because of AdMob. Their current version 12.0.0 requests READ_PHONE_STATE (bug), even if your app doesn't has it in the manifest. So that's it. They said they will release an update to 12.0.1 soon. – blackJack Mar 27 '18 at 18:13
@jaydip-kalkani, Asking the privacy policy is page is the choice of knowing what actually accessed(read/write) from the mobile through the app since the end user will not be technical guy. Also note that whatever sensitive data access is the matter and not only for the READ_PHONE_STATE, even it may be asked for READ_CONTACTS(just asking for an example). – Deva Oct 22 '18 at 12:39
1

The privacy policy setting in Google Play Console has been changed the path. Select Store presence > App content. Under "Privacy Policy". – OnJohn Apr 24 '20 at 05:24
As of the time of this comment - The Privacy policy setting is here - https://play.google.com/console/u/0/developers/<>/app/<>/app-content/privacy-policy – kiran01bm Jan 10 '21 at 22:00
12

Yes it has changed again. Scroll all the way down on the left menu to the `Policy` section and click `App Content`. Then the `Privacy Policy` is listed first and click `Start` – John Harding Feb 18 '21 at 23:35
What the heck I have to set a link on privacy policy for Internal Testing?? It is so dumb!! I just set a link on a privacy policy of another app and it started to accept new bundles with READ_PHONE_STATE permission. – Henadzi Rabkin Apr 16 '21 at 20:36
1

@Daniele free template is available here . https://app-privacy-policy-generator.firebaseapp.com/ – behrad Jul 19 '21 at 12:24

score 45 · Answer 2 · edited Sep 25 '18 at 15:24

45

Just try to add this line to your manifest file:

<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />

and add attribute xmlns:tools="http://schemas.android.com/tools" to your <manifest> tag to define namespace tools

From the documentation for tools:node="remove":

Remove this element from the merged manifest. Although it seems like you should instead just delete this element, using this is necessary when you discover an element in your merged manifest that you don't need, and it was provided by a lower-priority manifest file that's out of your control (such as an imported library).

edited Sep 25 '18 at 15:24

Lukas Würzburger

6,543
7
41
75

answered Dec 26 '16 at 17:59

Radi

6,548
18
63
91

2

This also circumvents the nasty permissions warnings that otherwise show up when someone is going to download your app...a must have – kwishnu Jul 20 '17 at 02:42
2

if use this you won't able to use READ_PHONE_STATE – Felix Aug 23 '17 at 07:54
4

[Fatal Error] :50:95: The prefix "tools" for attribute "tools:node" associated with an element type "uses-permission" is not bound. – manish kumar Sep 02 '17 at 11:50
2

Use this in manifest header? – Martin B Oct 06 '17 at 17:42

score 8 · Answer 3 · answered May 24 '18 at 13:58

8

It's third party library. You can find the culprit in build/outputs/logs/manifest-merger-release-report.txt

answered May 24 '18 at 13:58

Mateusz Kaflowski

2,221
1
29
35

Ajay Pandya · Answer 4 · 2018-05-11T05:36:04.213

It may be because of any third party lib which may include that permission so from my experience in this field You have to add the privacy policy regarding to that particular information it means if you ask get accounts permission in your app than you have to declare that with your privacy policy file we use that data i.e. email address or whatever with reasons like to login in google play game.

Also can do this

<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />

Hope This Will Guide you What You can do for this warning create privacy policy for your app and attach that with store listing.

Thanks :) but this will work ? – PriyankaChauhan May 05 '17 at 06:32 — PriyankaChauhan, May 05 '17 at 06:32

score 6 · Answer 5 · answered Feb 07 '17 at 08:48

The dependencies you have in your project, will add their own permissions. Please do the below to find from where "READ_PHONE_STATE" is coming.

Rebuild your android application
Press "Ctrl+Shift+F" in android studio (basically do a search all in the editor of your preference).
Search for "READ_PHONE_STATE", you would find the entry in a regenerated manifest file (not the one you originally created). By the path of it you can know, from which dependency the permission is getting added.

score 5 · Answer 6 · edited Feb 16 '17 at 00:06

5

you need to specify the min and target sdk version in the manifest file.
If not the android.permission.READ_PHONE_STATE will be added automaticly while exporting your apk file.

<uses-sdk
        android:minSdkVersion="9"
        android:targetSdkVersion="19" />

edited Feb 16 '17 at 00:06

GGamba

13,140
3
38
47

answered Feb 15 '17 at 20:59

user3262030

77
5

Great! That fixed it. It was getting added when I did not have target specified. – Tarun Varshney Feb 19 '17 at 01:53

score 5 · Answer 7 · answered Jul 29 '18 at 07:27

5

If you use React Native

This problem has been completely solved here

https://facebook.github.io/react-native/docs/removing-default-permissions

answered Jul 29 '18 at 07:27

Mahdi Bashirpour

17,147
12
117
144

score 5 · Answer 8 · answered Apr 15 '20 at 14:32

5

It can be that you need to add or update your privacy policy. You can easily create a privacy policy using this template

https://app-privacy-policy-generator.firebaseapp.com/

answered Apr 15 '20 at 14:32

Rahul Dange

2,371
20
15

score 5 · Answer 9 · answered Mar 30 '21 at 13:01

You need to provide a privacy policy for your app in the Google Play Console, or remove the permissions which require a privacy policy.

Go here: https://play.google.com/console/app/app-content/summary

Or open the Google Play Console for your app, scroll all the way to the bottom of the nav menu on the left and under the heading "Policy" click "App Content".

For more information on when and why the privacy policy is required, see the docs here.

score 3 · Answer 10 · answered Apr 02 '18 at 06:10

3

Currently some people are facing the same issue because of using 12.0.0 version of AdMob lib.

Update it to 12.0.1. This should fix it. You can read more here

answered Apr 02 '18 at 06:10

Parvesh

41
3

Links to external resources are encouraged, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. – baduker Apr 02 '18 at 06:31
This was the fix for me. In A-Studio, you can view the "merged manifest" and it points to the Google Play Libraries. – Matt D. Apr 10 '18 at 19:14

score 2 · Answer 11 · answered Dec 20 '16 at 04:53

If you're testing your app on a device > android 6.0 you have also to explicitely ask the user to grant the permission.

As you can see here READ_PHONE_STATE have a dangerous level.

If a permission have a dangerous level then the user have to accept or not this permission manually. You don't have the choice, you MUST do this

To do this from your activity execute the following code :

if the user use Android M and didn't grant the permission yet it will ask for it.

public static final int READ_PHONE_STATE_PERMISSION = 100;

  if (Build.VERSION.SDK_INT > Build.VERSION_CODES.M && checkSelfPermission(Manifest.permission.READ_PHONE_STATE)
                != PackageManager.PERMISSION_GRANTED) {
            requestPermissions(new String[]{Manifest.permission.READ_PHONE_STATE}, READ_PHONE_STATE_PERMISSION);
        }

then override onRequestPermissionsResult in your activity

@Override
    public void onRequestPermissionsResult(int requestCode, @NonNull String[] permissions, @NonNull int[] grantResults) {
        switch (requestCode){
            case READ_PHONE_STATE_PERMISSION: {
                if (grantResults[0] == PackageManager.PERMISSION_GRANTED){
                    //Permission granted do what you want from this point
                }else {
                    //Permission denied, manage this usecase
                }
            }
        }
    }

You should read this article to know more about it

score 2 · Answer 12 · edited Sep 28 '17 at 05:45

Are you using AdSense or other ads in your app, or maybe Google Analytics ? I think if you do so, even if you don't have the android.permission.READ_PHONE_STATE in your manifest this is added by the ads library.

There are free templates that might help you create a privacy policy.

This is the email i received from Google about it :

Hello Google Play Developer, Our records show that your app, xxx, with package name xxx, currently violates our User Data policy regarding Personal and Sensitive Information. Policy issue: Google Play requires developers to provide a valid privacy policy when the app requests or handles sensitive user or device information. Your app requests sensitive permissions (e.g. camera, microphone, accounts, contacts, or phone) or user data, but does not include a valid privacy policy. Action required: Include a link to a valid privacy policy on your app's Store Listing page and within your app. You can find more information in our help center. Alternatively, you may opt-out of this requirement by removing any requests for sensitive permissions or user data. If you have additional apps in your catalog, please make sure they are compliant with our Prominent Disclosure requirements. Please resolve this issue by March 15, 2017, or administrative action will be taken to limit the visibility of your app, up to and including removal from the Play Store. Thanks for helping us provide a clear and transparent experience for Google Play users. Regards, The Google Play Team

I think a good staring point for a free privacy policy can be found here: http://www.docracy.com/6516/mobile-privacy-policy-ad-sponsored-apps — Sebastiano Tognacci, Feb 03 '17 at 12:03
I get the same email with you, is there another possibility except Ads and GAnalytics? — wanz, Feb 10 '17 at 09:20

score 2 · Answer 13 · answered Mar 14 '17 at 17:00

2

Probably you're using PlayServices of version 9.6.0. Then you should update it, it's library's bug. More info here.

OR

Add

<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />

to your manifest file.

answered Mar 14 '17 at 17:00

Alexander Marochko

141
2
5

1

This topic is about READ_PHONE_STATE permission problem. Why android.permission.CAMERA? – Alexander Marochko May 30 '17 at 10:30

score 2 · Answer 14 · edited Mar 24 '18 at 22:28

2

You should drop android.permission.READ_PHONE_STATE permission. Add this to your manifest file:

<uses-permission
    android:name="android.permission.READ_PHONE_STATE"
    tools:node="remove" />

edited Mar 24 '18 at 22:28

answered Mar 24 '18 at 22:17

GIRIRAJ NAGAR

181
1
5

score 1 · Answer 15 · answered Mar 14 '17 at 13:16

1

1.You need to create privacy policy page on your website and update your privacy policy for the permissions you are asking.

2.Update new SDK remove unwanted permissions and resubmit the app.

answered Mar 14 '17 at 13:16

Kin Patel

11
2

score 1 · Answer 16 · answered Jul 05 '18 at 20:09

I found this free website that will make for you the policy AND host it:

https://www.freeprivacypolicy.com/

Then add it to the play store under Store Listing - at the bottom add the public link for the policy that you got from https://www.freeprivacypolicy.com/

score 1 · Answer 17 · edited Mar 27 '21 at 08:16

1

I solved this problem by this way: Google play console find App content-> Privacy policy and then Privacy policy URL set to you can submit your page.

edited Mar 27 '21 at 08:16

Dharman

30,962
25
85
135

answered Mar 27 '21 at 08:10

Mori

2,653
18
24

score 0 · Answer 18 · answered Mar 27 '18 at 18:19

2018 update:

For AdMob users, this causes AdMob version 12.0.0 (currently last version). It wrongly requests READ_PHONE_STATE permission, so even if your app doesn't require READ_PHONE_STATE permission in manifest, you won't be able to update your app in the Google Play Console (it will tell you to create a privacy policy page for your app, because your app requires this permission).

See this: https://developers.google.com/android/guides/releases#march_20_2018_-_version_1200

Also, they wrote they will publish an update to 12.0.1 fixing this soon.

score 0 · Answer 19 · answered Apr 11 '18 at 11:10

I was facing same issue and got the error while uploading apk to Google play. I used ads in my app, and I was not even mentioned READ_PHONE_STATE permission in my manifest file. but yet I got this error. Then I change dependencies for ads in build.gradle file. and then it solved my issue. They solved this issue in 12.0.1.

compile 'com.google.android.gms:play-services-ads:12.0.1'

score 0 · Answer 20 · answered Aug 19 '18 at 06:50

See steb by step and you will understood

public static String getVideoTitle(String youtubeVideoUrl) {
        Log.e(youtubeVideoUrl.toString() + " In GetVideoTitle Menu".toString() ,"hiii" );
        try {

            if (youtubeVideoUrl != null) {
                URL embededURL = new URL("https://www.youtube.com/oembed?url=" +
                        youtubeVideoUrl + "&format=json"
                );
                Log.e(youtubeVideoUrl.toString() + " In EmbedJson Try Function ".toString() ,"hiii" );
                Log.e(embededURL.toString() + " In EmbedJson Retrn value ".toString() ,"hiii" );
                Log.e(new JSONObject(IOUtils.toString(embededURL)).getString("provider_name").toString() + " In EmbedJson Retrn value ".toString() ,"hiii" );

                return new JSONObject(IOUtils.toString(embededURL)).getString("provider_name").toString();
            }
        } catch (Exception e) {
            Log.e(" In catch Function ".toString() ,"hiii" );

            e.printStackTrace();
        }
        return null;
    }

Please add some explanation to your code, such that others can learn from it — Nico Haase, Aug 19 '18 at 08:33

score 0 · Answer 21 · answered Aug 27 '20 at 15:10

If you are using the package device_id to get the unique device id then that will add an android.permission.READ_PHONE_STATE without your knowledge which eventually will lead to the Play Store warning.

Instead you can use the device_info package for the same purpose without the need of the extra permission. Check this SO thread

score -1 · Answer 22 · edited Jul 20 '21 at 06:19

I could not release my app on Google as error show after uploading app apk file on Google testing "internal testing release." Attached screen shot please resolve advise how to resolve this error. App generated on Mobiroller app generator. Even though after I have [Error massage seen: "Your APK or Android App Bundle is using permissions that require a privacy policy: (android.permission.CAMERA)." 1added privacy policy in Mobiroller in my app.

Error massage seen: "Your APK or Android App Bundle is using permissions that require a privacy policy: (android.permission.CAMERA)."

Warnings Your Apk Is Using Permissions That Require A Privacy Policy: (android.permission.READ_PHONE_STATE)

22 Answers22

Update 1

Update 2

Linked

Related