# Permissions Policy: Requesting Unnecessary or Restricted Permissions

**Guideline:** permissions/restricted-permissions · **Store:** Google Play · **Severity:** medium · **Fix difficulty:** medium · **Typical turnaround:** 2-6 hours

Canonical URL: https://appstorereject.com/rejections/google/permissions%2Frestricted-permissions/permissions-policy-requesting-unnecessary-or-restricted-permissions

## Description

Your app requests permissions that are not essential to its core functionality, or uses restricted permissions (SMS, call log, background location) without an approved Permissions Declaration Form. Google Play enforces the principle of least privilege — apps may only request permissions that are directly needed to implement current features advertised to users.

## Common variations

- ACCESS_BACKGROUND_LOCATION without approved justification or core feature need
- READ_SMS or RECEIVE_SMS permissions for apps that are not default SMS handlers
- READ_PHONE_STATE requested for non-essential features like analytics
- Broad permission requests at install time instead of contextual runtime requests

## Example rejection email

```
Issue found: Permissions policy — Use of restricted permissions

Your app requests the following restricted permission(s) without an approved Permissions Declaration Form:

• ACCESS_BACKGROUND_LOCATION

Restricted permissions require a valid use case and an approved declaration form. If your app's core functionality requires this permission, submit a Permissions Declaration Form in Google Play Console. If not, remove the permission from your AndroidManifest.xml.

Action required: Either submit a Permissions Declaration Form or remove the restricted permission(s) from your app.
```

## Resolution steps

## How to Fix Permissions Policy Violations

1. **Audit AndroidManifest.xml** — List every `<uses-permission>` in your manifest. For each one, document which feature requires it.

2. **Check merged manifest** — In Android Studio, open your `AndroidManifest.xml` and click "Merged Manifest" tab. Third-party SDKs may inject permissions you didn't declare directly. Use `tools:node="remove"` to strip unwanted SDK permissions:
   ```xml
   <uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />
   ```

3. **Remove unnecessary permissions** — If a permission isn't essential to a core, user-facing feature, remove it. Common offenders: READ_PHONE_STATE, ACCESS_FINE_LOCATION (when coarse is sufficient), READ_CONTACTS.

4. **Submit Permissions Declaration Form** — For restricted permissions you must keep (background location, SMS, call log), go to Play Console → Policy → App content → Permissions declarations. Explain the feature that requires it, why alternatives won't work, and include a demo video.

5. **Implement runtime permissions** — Request permissions at the moment the user triggers the related feature, not at app startup. Show a rationale dialog explaining why the permission is needed.

6. **Test permission-denied paths** — Ensure your app functions gracefully when permissions are denied. Never block the entire app for a non-essential permission.

## Before / after examples

**Before:** AndroidManifest.xml includes ACCESS_BACKGROUND_LOCATION, READ_PHONE_STATE, and READ_CONTACTS — background location is used only for a non-core 'nearby places' widget, phone state for analytics, contacts not used at all
**After:** Removed READ_PHONE_STATE and READ_CONTACTS entirely, replaced ACCESS_BACKGROUND_LOCATION with ACCESS_COARSE_LOCATION requested at runtime only when user opens the nearby places feature
**Why it works:** Only keep permissions essential to core features, request them contextually at runtime, and remove any injected by SDKs that your app doesn't need

## Common questions

**How long does this typically take to fix?**

Typical turnaround is 2-6 hours (difficulty: medium). After resubmission, most re-reviews complete within 24-48 hours.

---
*Machine-readable source: https://api.appstorereject.com/api/rejections/detail?slug=permissions-policy-requesting-unnecessary-or-restricted-permissions*