Phone verification without READ_CALL_LOG: what replaces call-based checks

These permissions are for apps registered as the user’s default SMS, Phone or Assistant handler, and only while they are the default. Google can grant temporary exceptions for a listed set of core uses when there is no alternative, such as backup and restore, caller ID and spam blocking, connected device companion apps, cross-device sync, device automation and some enterprise uses. Every such app must declare the permissions in the Play Console Permissions Declaration Form; apps that don’t qualify must remove them from the manifest.

The app requests a TS.43 token, a carrier-issued credential from the device’s SIM, through the Credential Manager API with an OpenID4VP request your backend builds. Your backend then exchanges the token with an aggregator or carrier for the verified phone number, so there is no one-time code for the user to receive or type. You need an account with an aggregator, usually a billable cloud API, and the API works on Android 10 (API level 29) and higher. Google’s guide also mentions Firebase Phone Number Verification as one option.

If you keep SMS codes, the SMS Retriever API reads them for you without any extra app permissions. Your app starts listening, your server sends an SMS with the one-time code and a hash that identifies your app, Google Play services passes that message to your app, and your app sends the code back to your server to confirm. The user never types the code. This matters more on Android 17: for most apps targeting API level 37, standard SMS messages with a one-time code, those not in the SMS Retriever or WebOTP format, become readable only three hours after receipt, so apps that read SMS to extract codes should move to the SMS Retriever or SMS User Consent APIs. Default SMS apps and connected device companion apps are among the exceptions.

January 27, 2027 also enforces the new contacts and location rules, see Android Contact Picker and the Android 17 location button. The full list is in Google Play policy updates 2026.

A smooth sign-up keeps the people you win; being found brings them. Censuus ranks apps by the visits they draw, and adding your app is free on the List my app form. Placement comes from traffic and sponsorship: apps climb on the visits they draw, and a sponsor can pay to rise higher.