After removing SMS permission from manifest, alert for removing app from playstore still shows

Question

In google play dashboard, this alert box is showing: Alert - this app will be impacted by a policy change. So I removed RECEIVED_SMS from manifest and use Google SMS retriever API to auto-detect SMS and upload app in play store 5 hrs ago and the app is published in play store. But the alert box is still showing. So do I need to do anything more except removing high risk or sensitive permissions?

Answer 1

We faced the same issue we did the following to get it resolved. It was caused because of one build in Internal test section, that was not being suppressed by higher levels.

We removed all the sensitive permissions and uploaded the build on 'Internal Test Track'. We moved that to Alpha then Beta and Production and then it didn't ask us to declare anything.

Answer 2

We had the same issue and I contacted google support. This was the answer:

you are trying to submit a new release that does not contain any sensitive permissions, however the Play Console is still prompting you to submit a Permissions Declaration Form. This is because one of your active releases (across all tracks you are using) does declare one of the sensitive permissions. To release a new compliant APK, please follow these steps:

Go to your Play Console. Select an app. On the left menu, select Release management > App releases. Next to the release type you want to create, select Manage. To create a new release, select Create release. Upload a new compliant APK. Fill out the Permissions Declaration Form: For “Compliance status,” select “No, this release does not meet the SMS and Call Log permissions policy” Select Save > Review at the bottom of the page. Click Start Rollout.

Even if you choose “No, this release does not meet the SMS and Call Log permissions policy” and get the notification email from us, your app will not be removed after March 9th if your active APK(s) still does NOT have sensitive or high-risk permissions until then. Also, the Permissions policy warning message in your Play Console Dashboard will disappear within one day if you don't have any active APK(s) with sensitive or high-risk permissions.

Answer 3

Had the same issue

I also removed the sms receive permission from manifest, and published new version to production, but the alert was still there.

I removed all the active releases from alpha/beta/internal channels, as well as from the artifact library, waited 24 hours, and the alert was finally gone.

Answer 4

If you indeed have published an apk without these permissions (see below), I believe it's a bug in the Google Play console and you shouldn't worry.

I'm still having this warning after removing those permissions a week ago. Thought the problem was having old apks in alpha & beta tracks, so I updated them also to the newer version, and it still warns me.

I even uploaded the same apk under a different package name just to make sure I follow the new rules - and voilà, the warning doesn't show for that app. This is why I think it's a bug and hopefully they'll use a better technique when needed to remove the non-compliant apps.

Steps to make sure your app's compliant:

1. Google didn't specify anywhere if these rules also apply on alpha/beta, or whether the use of these permissions on alpha/beta would affect the production, so just to make sure update these apks too.
2. Make sure you don't have a dependency for a library that requests/declares these permissions. You could verify it using 'analyze APK' in android studio, or inside the google play console, in the release info (where they specify all the declared permissions).
3. Make sure you have rolled out the updated apks to 100% of your users, in case you don't perform a full roll-out everytime.