App update getting rejected over and over on Play Store, in spite of removing SMS or CALL LOG permission

Question

I was facing a issue while uploading my apk. Play console was not allowing me to upload the apk and was giving this error "You can't edit this app until you create a new app release declaring sensitive permissions.".
I faced this issue after upgrading my app's minimum API level from 16 to 19. I did this to support a library which I integrated before uploading i.e. RazorPay. So, I rechecked if my merged Manifest added any unwanted permission, but it didn't. Just to be safe, I added the code to remove merged manifest permission. Still it didn't work.
I tried to trigger the declaration form by intentionally adding sms permission and filled it by anti-SMS phishing (randomly).

I am able to roll-out my app but since then, whenever I try to upload my app even without sms or call log permission, Google Play keeps on rejecting the app. There's no way to resubmit the declaration form with no permission selected.

Here are my manifest permission :

<uses-permission android:name="android.permission.READ_CONTACTS" />
    <uses-permission android:name="android.permission.WRITE_CONTACTS" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />


    <uses-permission android:name="com.google.android.providers.gsf.permission.READ_GSERVICES" />
    <uses-permission android:name="android.permission.CAMERA" />
    <uses-permission android:name="android.permission.GET_ACCOUNTS" />
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.VIBRATE" />
    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />


    <uses-permission
        android:name="android.permission.RECEIVE_SMS" tools:node="remove" />
    <uses-permission
        android:name="android.permission.READ_SMS" tools:node="remove" />
    <uses-permission
        android:name="android.permission.READ_CALL_LOG" tools:node="remove" />
    <uses-permission
        android:name="android.permission.WRITE_CALL_LOG" tools:node="remove" />
    <uses-permission
        android:name="android.permission.CALL_PHONE" tools:node="remove" />

Answer 1

After a long wait for Google Play Support team's response, they finally gave me a solution which worked.

Here is the E-mail from Google which solved my issue :

Hi,

Thanks for contacting Google Play Developer Support.

While the relevant team conducts an investigation on your issue, please follow the next steps and let us know about the result.

1. Go to the Play Console > click the App
2. On the left menu, click 'Release management' > 'App releases' > 'Manage' next to Production track. > 'Create release'
3. Next to 'Android App Bundles and APKs to add', click 'Add from library' > choose any old APK with sensitive permission (ie. version 10000) to see the declaration form.
4. Under Core functionality in declaration form, please choose other functionality(ie. 'Default SMS Handler') and uncheck 'Anti-SMS Phishing'.
5. Fill out all other requirements > Click 'Save'
6. Back to the top of the page, under 'Android App Bundles and APKs to add' section, click 'Remove' button next to the APK with sensitive permission (added on step #3).
7. Upload a new APK(with higher version code) which does NOT have sensitive permission. ---After step #7, there should be NO declaration form shown---
8. Hit 'Save' > 'Review' > 'Start Rollout'

If anyone comes around this problem, this can help.

Answer 2

First, you need to check if all the nasty permissions already removed. You need to check your current permissions by running the following command in your terminal/console:

aapt d permissions your.company.name.apk

see the Permissions in Google Play.

Then, mark them as removed.

Last, (this once happened to me), check your Application page in Google Play and try to find if you have Alpha or Beta version of the App. Remove them by making a release for Alpha or Beta without adding an apk to it. Then save and create the release. This should make the Alpha or Beta being overrided by the Production version.

Answer 3

Since you are using build variant then define it inside your highest priority manifest file

• Library manifest: lowest Priority
• Main manifest: Medium Priority
• Build Vairant manifest : Highest priority

Answer 4

Any android library needs to have an AndroidManifest.xml. So the issue may be that your library is making use of any permission that violates the google permission policy.

See this Post