Compliance & Policy

Android 17: New Contact Picker for App Privacy

Say goodbye to apps slurping your entire contact list. Android 17 is finally giving users control, a move long overdue.

Illustration of a hand holding a smartphone, with icons representing contacts and location dots emanating from the screen, signifying privacy controls.

Key Takeaways

  • Android 17 introduces a Contact Picker for granular app access to contacts, ending the 'all-or-nothing' permission.
  • Location permissions are also becoming more nuanced, allowing for in-the-moment requests and providing persistent usage indicators.
  • Google's Ad Safety report shows a significant increase in blocked policy-violating ads, highlighting ongoing challenges with the ad ecosystem.
  • While a positive step, granular contact access should have been implemented years earlier, and challenges with ad transparency and data privacy persist.

8.3 billion. That’s how many policy-violating ads Google blocked in 2025. While it sounds like a staggering number—and it is—it’s also a number that’s going up. The fact that Google is fighting this escalating digital wildfire, however, is overshadowed by a much more fundamental shift happening in the very fabric of our mobile experience: Android 17 is set to fundamentally alter how apps interact with your most personal data, starting with your contacts.

Look, for years, apps have treated your phone’s contact list like a digital buffet. Needed one phone number? Great, here’s the entire Rolodex. This wasn’t just an overreach; it was a digital key to your entire social graph, your family tree, your professional network. An app that could harvest every name, email, and number wasn’t just collecting data; it was mapping your universe for anyone willing to pay. This was the “show us all your contacts” dance, and we’ve been clicking ‘yes’ without a second thought.

A Granular Touch for Contacts

Android 17, currently simmering in preview, is dropping a new Contact Picker. Think of it less like a firehose and more like a carefully curated faucet. Instead of demanding your entire contact book just to find Aunt Mildred’s birthday, apps will now need to be specific. Want an email address? Fine. Just a phone number? Sure. But your cousin’s obscure mailing address? Not without a very good reason and a explicit user grant.

This isn’t just a tweak; it’s a platform-level change. Google’s updated Play policy is now mandating that apps use this Contact Picker or the Android Sharesheet for contact access. The old, all-or-nothing READ_CONTACTS permission will be relegated to apps that truly cannot function without it – a vanishingly small category, thankfully.

Location, Location, Privacy

And it’s not just contacts getting the privacy makeover. Location permissions are also set to become far more nuanced. Previously, it was a blunt instrument: precise or general, always or never. Android 17 adds layers, allowing apps to request your location in the moment, tied to a specific action. Looking for a nearby cafe? The app can ask for that precise moment’s location, no more, no less. Plus, a persistent indicator—much like the camera and mic alerts we’ve grown accustomed to—will finally let you know when your location is being tracked, offering transparency that’s been sorely lacking.

The Ad Problem is Real, and It’s Getting Worse

Google timed these privacy announcements with its latest Ad Safety report. The 8.3 billion blocked ads figure is up from 5.1 billion in 2024. This jump isn’t just Google getting better at its job (though that’s part of it); it suggests the sheer volume of malicious and policy-violating ads is exploding. Scam ads alone saw a massive surge, from 415 million in 2024 to 602 million in 2025.

Google blocked 8.3 billion policy-violating ads and suspended 24.9 million advertiser accounts in the last year.

Scammers know more about you than you think. These invasive profiles, built from years of overreaching data collection, fuel these aggressive, often dangerous, advertising campaigns. We’ve seen sponsored search results that masquerade as genuine queries, leading users straight into infostealer malware traps. Why? Because at its core, Google’s empire is built on advertising revenue.

A Cautious Applause

So, we’ll give Google a cautious hand clap. They’re tackling the problem from both ends: limiting what data apps can grab and trying to clean up the ad ecosystem that weaponizes it. But let’s be clear: granular contact access should have been a default feature years ago. Apple started this process with iOS 18 eighteen months ago, and even that felt like playing catch-up.

And while Google boasts of blocking over 99% of violations before they reach users, that remaining 1% of an astronomical number is still a frighteningly large quantity. The ads that slip through do real damage. We’re still grappling with the legacy of reports about Google knowingly sharing children’s data or mishandling health information. The path forward is positive, but the stumbles of the past still give us pause.

This is the fundamental shift we’re talking about. AI is not just a new tool; it’s a new operating system for the digital world. And with Android 17, Google is finally acknowledging that the foundation of that OS needs to be built on user privacy, not unchecked data harvesting. It’s a monumental step, one that many of us have been advocating for, and it’s about time.

Will This Change How Developers Build Apps?

Absolutely. Developers will need to re-architect how they request and handle contact information. Instead of a blanket permission, they’ll need to integrate with the Contact Picker, prompting users for specific data points. This means more thoughtful UI design and a deeper consideration of why an app actually needs a user’s contact details. For location, it’s about contextually requesting access rather than a persistent background grab. This is a move towards more ethical development practices, pushing developers to be more deliberate with user data.

What is the new Contact Picker?

The new Contact Picker in Android 17 allows users to grant apps access to specific contacts or contact information (like just a phone number or email address) rather than their entire contact list. It’s a more granular and privacy-friendly way for apps to access user data.

How does Android 17 improve location privacy?

Android 17 introduces more nuanced location permissions. Apps can request location access tied to a specific action or in the moment, and a persistent indicator will alert users when their location is being used. Users will also have more transparency in seeing which apps are tracking their location.

Is this the end of all data harvesting by apps?

No, but it’s a significant step in the right direction. While Android 17 is making contact and location data access more granular and transparent, apps can still collect other types of data. However, by addressing broad access to sensitive personal information like contacts, Google is forcing a more ethical approach to app development.


🧬 Related Insights

Written by
Threat Digest Editorial Team

Curated insights, explainers, and analysis from the editorial team.

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Malwarebytes Labs

Stay in the loop

The week's most important stories from Threat Digest, delivered once a week.