Contact data at risk

Contact information, such as names, addresses, and phone numbers, is a type of sensitive data that users commonly store on their mobile devices. If accessed by a harmful app, this information could be stolen and sent to suspicious servers, leading to potential fraud or scams.

Google’s new Android 18 changes

Starting with Android 18, Google is implementing significant changes to how apps handle contact data. Previously, apps that requested access to a user’s address book could modify all contacts in the background without user confirmation, creating security risks.

Restricting app access

Under the new system, apps that need to modify a user’s contact list will only be able to access one contact at a time. This change includes a native pop-up that asks the user which contact they want to edit or add, increasing user control and awareness.

Special access for full contact access

Apps that require full access to a user’s contact list will need to request a "special access" permission, similar to how apps request access to system overlays or all files. This permission will be treated with caution and should be granted only when necessary.

Standardizing contact management

This update aims to eliminate the inconsistencies in how contact management is handled across different Android versions and manufacturers. While the new permissions are mandatory for Android 18, they will also start appearing in Android 17 (QPR2) by the end of the year.

Simplifying contact sharing

Google is also improving the way users can share their contacts. This includes features similar to those found in alternative Android versions like GrapheneOS, which allow users to set specific "contact access scopes" to limit an app’s access to only the necessary information.