Why does my app has the READ_PHONE_STATE permission although it's not declared in manifest?

Question

I noticed the READ_PHONE_STATE permission when I uploaded the apk to google play. I have not added it and it is not written anywhere in my manifest or any other file of my project. (I looked through all libraries for this permission)

My app did not have this permission in my previous build with same libraries. Since last build I updated android studio to version 1, updated my android sdk and made a few changes (in code) to my app. I don't request the device ID in my app.

My app has minSDK 14 and no ads. Here are my manifest permissions:

<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.VIBRATE" />
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

Here's the apk file

Answer 1

I was able to resolve the problem. It's similar to the solution of reneph.

I found that one library had no minSDK specified neither in the build.gradle nor in the manifest file. After adding

defaultConfig {
    minSdkVersion 14
    targetSdkVersion 21
}

the permission was gone. I don't know why it worked without the permission on my previous build (also no minSDK specified). Must have been either the Android Studio 1.0 or the Android SDK update.

---

Android developer documentation for READ_PHONE_STATE permission:

Note: If both your minSdkVersion and targetSdkVersion values are set to 3 or lower, the system implicitly grants your app this permission. If you don't need this permission, be sure your targetSdkVersion is 4 or higher.

Answer 2

I found the issue.

I had another library included that had minSdkVersion="4" (its not my library, but my app requires minSdkVersion="14"). I just changed the minSdkVersion of the additional library to 14 and the permission disappeared!

I declared the following permissions in my app:

<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="com.android.vending.BILLING" />
<uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES" />
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
<permission-group android:name="android.permission-group.STORAGE" />

Answer 3

--- WORKED FOR ME!-- I tried so many things on manifest, which mentioned here and other forums.

At the last, I noticed that the error message, The apk upload error message wants to add "Privacy Policy URL" into Store listing / Privacy policy section. (which checked "Not submitting a privacy policy URL at this time").

So, I add my privacy policy URL from my website, then submit. later, I successfully uploaded my apk.

Answer 4

One cause could be a (transitive) dependency, i.e. a library, that declares a minimum required Android SDK level below 4. In this case the "manifest merger tool" will add those permissions implicitly.

Lower-priority manifest declares                   Permissions added to the merged manifest

targetSdkVersion <= 3                              WRITE_EXTERNAL_STORAGE, READ_PHONE_STATE 
targetSdkVersion <= 15 and using READ_CONTACTS     READ_CALL_LOG 
targetSdkVersion <= 15 and using WRITE_CONTACTS    WRITE_CALL_LOG

Source: https://developer.android.com/studio/build/manifest-merge#implicit_system_permissions

Look into the manifest-merger-*-report.txt log, found in build/outputs/logs if this was case.