Library non-compliant with Google Play Contacts Permissions policy (deadline 2026-10-28)

[varungandhi121]

---

Heads up: Google Play policy deadline affects this library

Google Play announced a new Contacts Permissions policy on April 15, 2026, with a compliance deadline of October 28, 2026.

Under the new policy, apps that only need a user to pick a single contact must use the Android Contact Picker instead of declaring READ_CONTACTS. Apps that continue to declare broad
access will be blocked from Play Store updates after the deadline.

Reference: https://support.google.com/googleplay/android-developer/table/12921780 (search "Contacts Permissions")

The issue

Every contact-retrieval method in this library (getAll, getContactById, getContactsMatchingString, getContactsByPhoneNumber, getContactsByEmailAddress, etc.) requires READ_CONTACTS.

There is currently no method that lets apps pick a single contact without broad permission — which is exactly what Google's new policy requires.

Request

Please update the library to comply with the new Google Play guideline before October 28, 2026, so apps depending on react-native-contacts don't get blocked on the Play Store.

Thanks!

[idanlevi1]

@varungandhi121 If you only need to pick a single contact, react-native-pick-contact already does exactly what Google's new policy requires — it uses the native OS contact picker (ActivityResultContracts.PickContact() on Android, CNContactPickerViewController on iOS) instead of declaring READ_CONTACTS.

Built for the New Architecture (TurboModule + codegen), RN 0.76+, minimal API: pickContact() → { name, phone }.

For apps that only need single-contact selection, this is a drop-in compliant solution without waiting for a major refactor of this library.

[ankit-ndev]

Hey @idanlevi1 — first, thanks for building this library. It's currently the only RN solution aimed at the October 2026 Google Play compliance deadline, so it fills a real gap.

While testing across devices I ran into a bug that unfortunately defeats the whole purpose of the library: it always triggers a READ_CONTACTS permission dialog on first launch — tested on Pixel (AOSP), Samsung, OnePlus, and Oppo.

---

Root cause

The library uses ActivityResultContracts.PickContact() internally, which fires vnd.android.cursor.dir/contact and returns a contact-level URI. On Android 16 (API 36) and below — including Pixel and Samsung — the temporary URI permission granted by the picker does not cover the /data sub-path. So when the library tries to query the phone number, the cursor comes back empty and it falls back to requesting READ_CONTACTS. Verified on a Pixel 9 emulator (API 36).

---

The fix

For API < 37, the correct zero-permission intent is:

Intent(Intent.ACTION_PICK, ContactsContract.CommonDataKinds.Phone.CONTENT_URI)

This returns a Phone data row URI — name and phone are in a single cursor row, no sub-path traversal, no permission needed. Works on all tested devices.

For API 37+, Android automatically upgrades ACTION_PICK to the new Contact Picker UI, so no code change is needed for single-select.

Session URI rules for ACTION_PICK_CONTACTS responses:

• Contains one row per contact × data-type, grouped by _ID
• selection and selectionArgs must be null — passing them raises an exception
• Use LinkedHashMap to group by _ID and preserve tap order

Reference: https://developer.android.com/about/versions/17/features/contact-picker

Thanks !