Do I need a declaration for the SMS permission?

Do I need a declaration for the SMS permission

Yes. Google Play treats SMS as a restricted, high-risk permission, and apps that request it may need a Permissions Declaration Form and approval before release. If your app does not qualify for a permitted SMS use, remove the permission from your manifest instead of trying to push through review.

The part people get wrong is thinking that any app can ask for SMS access if it explains the feature well enough. Google Play does not work that way. SMS access is only allowed for supported core functionality, and the app must fit one of Google’s permitted use cases, such as default SMS handling or another approved exception.

You should expect the declaration prompt during the release process after uploading an app bundle that requests the permission. If an active release track includes an undeclared restricted permission, Play Console can surface an App content alert, and you cannot publish changes until you either submit the declaration or remove the permission.

The inconvenient part is that a declaration is not a formality. Google says the review looks at your app’s core functionality, the declared use case, instructions for the reviewer, and a video demonstration. If your app is signed-in only, you also need instructions to reach the restricted content.

For SMS, the safest path is usually to ask one question first: does the app truly need SMS permission, or does a safer alternative cover the job Google points to alternatives such as SMS Retriever for verification, the SMS Intent for starting a message, the Share Intent for sharing, and the Dial Intent for starting a call without sensitive permissions.

If your app’s only SMS use is verification codes, Google’s guidance points away from SMS permission and toward SMS Retriever or manual code entry. That matters because Play policy is built around minimizing access to sensitive user data, not around approving every convenience feature that touches messages.

If your app is a default SMS handler, the permission case is stronger, but the rule still stays narrow. Google says apps must be actively registered as the default SMS, Phone, or Assistant handler before prompting users for the related permissions, and they must stop using the permission when they are no longer the default handler.

The part that usually causes rejection is scope creep. Google’s policy says only use SMS permissions when the app’s critical core functionality requires them. If you want SMS for analytics, research, ad targeting, or background convenience features, that is outside the allowed pattern and can lead to removal or suspension.

If you are unsure whether your use qualifies, read the restricted-permissions policy before building the release around it. That is faster than submitting, getting blocked, and then having to strip the permission, rebuild, and resubmit. DevConnect’s job pages and testing flow can help you validate the app with real testers on your own property, but it does not replace Google Play’s permission review. https://devconnectplatform.com

A practical example helps. An app that sends and reads SMS because it is the user’s default texting app should prepare a declaration and reviewer instructions. An app that only wants one-time password autofill should usually remove SMS permission and use the SMS Retriever API instead. Those are not the same policy path, and Google reviews them differently.

Another easy mistake is assuming that adding the permission now and “explaining it later” is acceptable. Google explicitly says deceptive or undeclared uses can lead to suspension, and apps that do not meet policy requirements or lack a declaration may be removed from Google Play. Build the release around the permission rules, not the other way around.

If SMS is only present because of an old dependency, audit the manifest and the libraries before the next release. A lot of apps inherit permissions from SDKs or copied samples and never notice until Play Console flags them. Removing an unnecessary permission is usually the cleanest fix, because it avoids review, reduces user friction, and lowers the chance of a policy problem later.

If your app really does need SMS access, prepare the declaration with the exact use case, reviewer steps, and a short video that shows the core feature working. If it does not, remove the permission and ship without it. That is the decision Google Play expects you to make before release, not after the rejection email arrives.