Android is locking down permissions to keep apps from messing with your contacts

Keeping Android users safe is one of the most challenging problems Google faces with its mobile operating system, and one of the many ways it’s managed to address the task is through the development of Android’s permission system. By only granting apps a narrow set of permissions that they truly need, we can limit the ability of secretly malicious or otherwise compromised apps to do harm. Today we’re leaning about an update to how permissions work when it comes to contacts, and why Google’s making the change.

Over on X, Google’s Mishaal Rahman is highlighting some upcoming changes for how apps are allowed to manage our contacts on Android, further detailed in a developer blog post. Right now, the problem is that contacts permissions aren’t granular enough — an app that just wants to add or update one contact gets the same WRITE_CONTACTS permission that an app that wanted to change all of your contacts would.

Android 17 already started limiting how apps are able to read our contacts, and now with Android 18, Google’s planning to make similar changes to how apps write to our contacts. Instead of the current all-or-nothing approach, Google is standardizing contact intents to let apps request individual insert or edit rights that only operate on a single contact at a time. Here’s a mock-up at how the interface might end up looking:

What’s the harm of an app having broader contacts permissions than it actually needs? As Rahman points out, an app could make sweeping changes to your stored contacts, replacing saved info with fake data designed to trap you in a scam, potentially impersonating loved ones. By keeping access intentionally narrow, Android 18 would limit the ability for such an attack to go unnoticed.

But what about software that legitimately needs to update dozens of contacts, all at once? Sure, contact managers exist — like Google’s own Contacts app — and these will be able to keep on operating like normal. Unlike apps only working with single contacts now and then, these will get access to a brand new MANAGE_CONTACTS permission, formally arriving with Android 17 QPR2 later this year.

The good news is that you don’t have to worry about any of this yourself, and it’s instead incumbent upon developers to update their apps to start using these granular intents when targeting Android 18.