Google Play permissions policy rejection

How to clear a permissions rejection

Follow these steps in order. Each one is something we do on client work.

1. Find the permission. The notice names it. Search your merged manifest, not just your own manifest, because libraries add permissions.
2. Decide if you need it. If the core feature doesn't need it, remove it, including from library manifests with a tools:node="remove" rule.
3. If you need it, justify it. Fill in the Play Console declaration and explain the core user-facing feature that requires it.
4. Record a demo video if asked. Show the feature using the permission, from launch to use.
5. Add an in-app explanation. Show why the app asks before the system prompt appears.
6. Ship a new build. Upload with a higher versionCode and make sure older tracks don't still carry the permission.

Google Play permissions rejection: key rules and context

What the rejection means. Google restricts high-risk permissions to specific use cases (Play Console Help: Permissions).

Why it usually happens

• A library adds READ_SMS or QUERY_ALL_PACKAGES you didn't notice.
• Background location used for a feature that works with foreground location.
• MANAGE_EXTERNAL_STORAGE used where scoped storage would work.

How to fix it

1. Inspect the merged manifest in Android Studio.
2. Remove permissions with tools:node="remove" where not needed.
3. Use alternatives: scoped storage, photo picker, foreground location.
4. For real needs, fill the Permissions Declaration Form with a short video showing the feature.

Appeal or resubmit? After removing a permission, submit a new release. If declared, wait for review; appeal only with clear evidence of the core use case.

How to avoid it next time. Review merged manifests on every dependency update.

Common mistakes

• Checking only your manifest. Libraries merge their permissions in.
• Leaving the permission on another track. Active test tracks count too.
• Generic justifications. Explain the specific feature.
• No in-app context. Users and reviewers both need to see why you ask.

If you want this handled for you, our pricing page lists every fixed package.

Worked example (hypothetical)

This example is illustrative. The app is made up, and so are any numbers in it.

Imagine a to-do app, TickOff, flagged for a broad storage permission it never uses. The merged manifest shows an old image-picker library added it. We'd swap to the system photo picker, remove the permission with a manifest merge rule, and check closed and internal tracks so no active release still declares it.

Google Play rules that trip most apps

These come from Play Console Help pages we checked on 26 October 2026.

Checklist

Copy this list into your release notes or ticket and tick each item off before you ship.

• Merged manifest reviewed
• Unneeded permissions removed
• Declaration filled for kept permissions
• Demo video ready if needed
• In-app rationale screen
• All tracks updated

Sources

• Google Play Console Help: Permissions and APIs that access sensitive information (accessed 26 October 2026)
• Google Play Developer Policy Center (accessed 26 October 2026)
• Play Console Help: Metadata policy (accessed 26 October 2026)
• Play Console Help: App testing requirements for new personal developer accounts (accessed 26 October 2026)
• Play Console Help: Add preview assets to showcase your app (accessed 26 October 2026)
• Play Console Help: Create and set up your app (accessed 26 October 2026)