Did Google Play change SMS permission rules for account verification?

Did Google Play change SMS permission rules for account verification

Yes. Google Play now treats account verification via SMS as an invalid use of SMS permissions, and it points developers to SMS Retriever or manual code entry instead. Google also says account verification via phone call is no longer approved for the READ_CALL_LOG use case.

The part people get wrong is simple: they assume “we only read a verification code” makes the permission acceptable. Google Play’s current policy says the opposite for the SMS permission group. Account verification via SMS is listed among invalid use cases, and the approved alternative for SMS OTP and account verification is the SMS Retriever API, which avoids extra app permissions.

The inconvenient part is that this is not a cosmetic policy note. If your app does not qualify for access to SMS or Call Log permissions, Google says you must remove those permissions from the manifest. If you do qualify for a restricted use case, you must declare the permissions in Play Console and keep the use case aligned with what Google allows.

For most apps, the right move is to stop asking for SMS permission just to read a one-time code. Google’s own alternatives section says you can use the SMS Retriever API, which works without requiring the user to grant sensitive permissions, or you can let users type the code manually if Retriever is not an option. That is the path Google documents for account verification.

Google’s 2026 policy announcement makes the direction clearer, not looser. The July 15, 2026 update says account verification via phone call is no longer an approved use case for READ_CALL_LOG, and it recommends Digital Credentials API or SMS Retriever instead. That update is about calls, not SMS verification, but it reinforces the same pattern: sensitive telephony permissions are being narrowed, not expanded.

The practical test is this: if your flow needs the app to automatically pull an SMS code, use an API designed for that purpose. If your flow needs broad SMS access, Google expects a core app function that fits the permitted uses, such as a default SMS handler or an eligible exception. Account verification by itself does not meet that bar.

If you are updating an existing app, check the manifest, the permissions declaration, and the actual login flow together. A common failure is leaving READ_SMS in place because an older SDK or old code path still references it. Google says deceptive or undeclared uses can lead to suspension, so the policy review needs to match the shipped behavior, not just the intended behavior.

For teams building on DevConnect, the safe pattern is to keep verification inside your own product and avoid any shortcut that relies on sensitive permissions you do not need. DevConnect itself is free to use, and it is separate from Google Play policy. If you are also testing your app on Play, the policy page on support.google.com is the source you should follow for permission scope.

A concrete example helps. If your app sends a 6-digit login code by SMS, then tries to request READ_SMS so it can auto-read that message, Google Play will treat that as the wrong use case unless you fit an allowed exception. If you switch to SMS Retriever, the code can still arrive by SMS, but the app does not need the sensitive permission.

That is the current answer: yes, Google Play tightened the rule, and account verification is not a permitted reason to request SMS permission. Build the verification flow around SMS Retriever, manual code entry, or another approved method, then remove any leftover SMS permission request that is only there for login.

FAQ

Can an app still use SMS for login codes Yes, if it uses an approved method like SMS Retriever or manual entry. Google’s policy page specifically lists SMS OTP and account verification as a case where SMS Retriever avoids extra permissions.

Does this rule mean all SMS permissions are banned No. Google Play still allows SMS permissions for narrow, documented core uses, such as default SMS handling or approved exceptions. Account verification alone is not one of those uses.

What happens if an app keeps an unapproved SMS permission Google says apps that do not qualify must remove the permission, and deceptive or undeclared use can lead to suspension or account termination. The review must match the actual behavior shipped in the app.

Is phone-call verification allowed under the same rules No. Google’s July 15, 2026 announcement says account verification via phone call is no longer approved for READ_CALL_LOG, and it recommends alternative APIs instead.

Where should developers check the current policy text Use Google Play’s Help Center pages on SMS and Call Log permissions and the policy announcement pages in Play Console Help. Those pages are the current source of truth for allowed uses and alternatives.