Privacy-First Permissions Become Mandatory on Google Play
Starting October 27, google play policy will require apps to adopt privacy-friendly alternatives for accessing contacts and location data. The updated guidelines mandate use of the Android Contact Picker and a new location button for one-time access requests. Apps that require persistent, full-scope access must justify this need through a new Play Developer Declaration form.
These changes align with broader platform shifts toward minimizing permission grants. Apps targeting Android 17 and above that use contacts for sharing or invites must migrate to the Contact Picker and remove READ_CONTACTS entirely. Similarly, apps requesting precise location for discrete, temporary actions — such as finding a nearby store or tagging a photo — must implement the new location button unless they can demonstrate a core functional requirement for persistent access.
Google is supporting this transition with new tooling. By October, Play Policy Insights in Android Studio will flag apps that should adopt these features and provide step-by-step guidance. Pre-review checks in Play Console will catch potential violations before submission, reducing friction during wiki:app-review-process.
Apple Removes Apps for Guideline Violations — No Matter the Developer
Apple removed two high-profile apps in mid-April, reinforcing that app store guidelines apply uniformly regardless of an app's popularity or the developer's public profile. The first, Freecash, had reached the #2 spot in the U.S. App Store in January after misleading TikTok ads promised users up to $35 per hour for watching videos. Instead, the app collected extensive personal data — including race, religion, health, and biometrics — and funneled users toward in-app purchases and paid ads in third-party games.
Freecash remained live for months after public reporting exposed its practices. Apple only acted after direct media inquiry, citing violations of guidelines prohibiting scam practices and misleading marketing. The app had been downloaded 5.5 million times across iOS and Android and appears to have used bot-driven ratings and possibly acquired an existing App Store listing to bypass review.
The second removal involved Grok, xAI's chatbot app, which was generating nonconsensual sexualized deepfakes of real people. Apple privately warned xAI in January that the app violated content moderation policies and would be removed unless substantive changes were made. After rejecting an initial fix as insufficient, Apple eventually approved a revised submission — but the incident became public only after senators urged both Apple and Google to pull the app and Apple disclosed its enforcement actions in a response letter.
The Grok case is particularly notable because it tests Apple's longstanding defense of its curated App Store model: that human wiki:app-review keeps users safer. Allowing a high-profile app to generate exploitative content undermines that claim in the eyes of both regulators and the public.
Developer Testing and Demo Accounts
Developers submitting apps with third-party authentication — such as Sign in with Google or Sign in with Apple — must provide functional demo accounts during review. There is no requirement to implement a separate username/password system solely for testing purposes. Instead, providing a demo Google or Apple account that reviewers can use to access the app's full feature set satisfies wiki:app-store-submission-process requirements. The key is ensuring reviewers have unobstructed access to all account-based features without requiring personal credentials or payment.
What This Means for Practitioners
On Google Play, the October deadline is firm. Apps that currently rely on READ_CONTACTS or persistent precise location permissions should audit their use cases now. If your app uses contacts for one-time sharing, invites, or lookups, migrate to the Contact Picker and remove the broad permission. If you genuinely need full contact list access, prepare your justification and plan to submit the declaration form as soon as it becomes available.
On Apple's platform, enforcement is increasingly reactive to public scrutiny but no less consequential. Misleading marketing, excessive data collection, and content moderation failures are all grounds for removal — even after months of inaction. The Freecash and Grok cases show that Apple will act when pressed, and that initial approval does not guarantee long-term App Store presence if guideline violations come to light.
For both platforms, the shift is toward higher transparency and more granular user control over permissions. Apps that treat privacy as an afterthought or use deceptive acquisition tactics face growing enforcement risk. The safest path forward is proactive compliance: audit permission requests, adopt privacy-friendly APIs, and ensure marketing claims match actual app behavior.