Why does my app has the READ_PHONE_STATE permission although it's not declared in manifest?

Question

I noticed the READ_PHONE_STATE permission when I uploaded the apk to google play. I have not added it and it is not written anywhere in my manifest or any other file of my p

Answer 1

--- WORKED FOR ME!-- I tried so many things on manifest, which mentioned here and other forums.

At the last, I noticed that the error message, The apk upload error message wants to add "Privacy Policy URL" into Store listing / Privacy policy section. (which checked "Not submitting a privacy policy URL at this time").

So, I add my privacy policy URL from my website, then submit. later, I successfully uploaded my apk.

Answer 2

I was able to resolve the problem. It's similar to the solution of reneph.

I found that one library had no minSDK specified neither in the build.gradle nor in the manifest file. After adding

defaultConfig {
    minSdkVersion 14
    targetSdkVersion 21
}

the permission was gone. I don't know why it worked without the permission on my previous build (also no minSDK specified). Must have been either the Android Studio 1.0 or the Android SDK update.

---

Android developer documentation for READ_PHONE_STATE permission:

Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don't need this permission, be sure your targetSdkVersion is 4 or higher.

Answer 3

I found the issue.

I had another library included that had minSdkVersion="4" (its not my library, but my app requires minSdkVersion="14"). I just changed the minSdkVersion of the additional library to 14 and the permission disappeared!

I declared the following permissions in my app:

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="com.android.vending.BILLING" />
<uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES" />
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
<permission-group android:name="android.permission-group.STORAGE" />

Answer 4

One cause could be a (transitive) dependency, i.e. a library, that declares a minimum required Android SDK level below 4. In this case the "manifest merger tool" will add those permissions implicitly.

Lower-priority manifest declares                   Permissions added to the merged manifest

targetSdkVersion <= 3                              WRITE_EXTERNAL_STORAGE, READ_PHONE_STATE 
targetSdkVersion <= 15 and using READ_CONTACTS     READ_CALL_LOG 
targetSdkVersion <= 15 and using WRITE_CONTACTS    WRITE_CALL_LOG

Source: https://developer.android.com/studio/build/manifest-merge#implicit_system_permissions

Look into the manifest-merger-*-report.txt log, found in build/outputs/logs if this was case.