1. The Contacts Permissions policy (announced April 15, 2026) governs broad access to users' device contacts: the READ_CONTACTS permission is only allowed when contact management is a core feature of the app (for example contact backup, CRM, or sync apps). 2. Apps that do not need the full contact list must integrate the Android Contact Picker, which lets users select individual contacts at runtime without granting the app broad, app-wide contacts access. 3. If you request READ_CONTACTS, declare a justified core use case in the Play Console Data Safety form and be ready to complete the App Access declaration during review if requested. 4. Using contacts data for advertising, analytics, or resale is a direct policy violation regardless of user consent. 5. Apps whose current use of READ_CONTACTS no longer qualifies must remove the permission and migrate to the Contact Picker before the enforcement date. 6. Data picked via the Contact Picker is still user data - disclose it in the Data Safety section and comply with the User Data policy (secure handling, deletion on request). 7. Keep the permission declaration in Play Console in sync with the actual code to avoid mismatches that can block review or trigger enforcement.