April 2026 Google Play Policy Updates: Key Changes for Contacts Permissions, Location Privacy & Account Transfers

On April 15, 2026, Google published its latest round of Google Play policy changes — a significant update that touches permissions, privacy, account security, health data, and content classification. Unlike routine clarifications, this update introduces two entirely new policies and materially revises several existing ones, with enforcement deadlines as tight as 30 days.

For app developers and app marketers, this isn't just a compliance checklist. These changes signal where Google is heading: toward a platform where user data access is minimized by default, account security is formalized, and privacy enforcement is increasingly automated. Understanding the strategic implications — not just the technical requirements — is what separates teams that thrive from those that scramble.

Here's a breakdown of every major change, what it means for your app, and exactly what you should do about it.

New Policy: Contacts Permissions — The End of Broad Address Book Access

Google is introducing a dedicated Contacts Permissions policy that fundamentally changes how apps access users' address books. The new standard is clear: apps that don't require broad access to contacts must use the Android Contact Picker — a system-level UI that lets users select specific contacts to share, rather than granting full READ_CONTACTS permission.

This is a major shift. Previously, many apps — from social platforms to messaging tools to CRM utilities — requested blanket contacts access during onboarding. Under the new policy, that approach will trigger enforcement action unless the app can demonstrate a clear, core-functionality justification for broad access.

New Policy: Mandatory Account Transfer Workflow

Google is formalizing how developer account ownership changes hands. Starting May 27, 2026, the only permitted method for transferring a developer account is the official "Transfer ownership" workflow within the Play Console. The system includes a mandatory seven-day security delay designed to detect and prevent unauthorized transfers.

This directly targets a long-standing gray market practice: buying and selling Google Play developer accounts through credential sharing, which has been associated with fraud, policy evasion, and account hijacking. If you're planning any account restructuring — whether due to a corporate acquisition, team reorganization, or portfolio consolidation — you need to use the official process.

Updated Policy: Location Permissions and the New "Location Button"

Google is updating its Location Permissions policy with a significant UX and privacy change: the introduction of a system-level "location button" as the recommended minimum scope for precise location access. Instead of navigating multi-step permission dialogs, users can grant one-time, temporary access to precise location with a single tap.

For developers, this means:

• Apps that need one-time location access (e.g., finding nearby stores, checking local weather) should adopt the location button as their primary access method.
• Apps that require continuous or background location tracking must formally justify that need through a developer declaration process — and "nice to have" use cases won't qualify.
• Geofencing is no longer an approved foreground services use case. Developers relying on foreground service geofencing must migrate to the dedicated Geofence API.

This is part of a broader pattern. Google has been systematically tightening permissions access with each Android version, and the March 2026 system updates already signaled this direction. The April policy codifies these changes into enforceable requirements.

Health Data: Granular Permissions and New Prohibited Use Cases

Google is updating its Health and Fitness data guidelines to support granular permissions in Android 16 and newly supported Health Connect data types. The update adds high-sensitivity categories including Menstrual Cycle Phases, Alcohol Consumption, and Symptoms.

Critically, Google is also clarifying prohibited use cases: sensitive health data cannot be used for determining employment eligibility, insurance eligibility, or unauthorized social sharing. If your app integrates with Health Connect, review the Health Connect policy update alongside these new requirements to ensure full compliance.

Clarifications: Photo/Video Permissions and Age-Restricted Content

Two policy clarifications are worth noting, even though Google states enforcement standards remain unchanged:

• Photo and Video Permissions: Google has streamlined its guidance for developer ease. If your app accesses photos or videos, review the updated language to ensure your permission justifications align with the clarified expectations.
• Age-Restricted Content: Apps with dating/matchmaking as an incidental feature are no longer required to implement Restrict Minor Access in Play Console — provided they maintain effective alternative age-gating mechanisms. This is relevant for social apps, community platforms, and lifestyle apps that include dating-adjacent features without being classified as dating apps. For deeper context on age-gating requirements, see our coverage of the EU age verification developments and how they intersect with Google Play's own standards.

Prediction Markets: A New Global Pilot Program

Google is launching a global pilot program for prediction market apps that allow real-money transactions. Apps in this category must enroll by June 1, 2026, or face removal. This follows a broader regulatory trend — prediction markets have gained mainstream attention, and Google is creating a controlled compliance pathway rather than an outright ban.

If your app includes any prediction or wagering functionality — even as a secondary feature — check whether the pilot program applies to you. The enrollment deadline is firm.

What This Means for Your ASO and App Marketing Strategy

Policy compliance and ASO are increasingly intertwined. Here's how these changes should inform your marketing approach:

1. Update Your Data Safety Section Immediately

Every permission change — contacts, location, health data — requires a corresponding update to your Data Safety declarations. Mismatches between declared and actual behavior are among the most common triggers for listing suppression and removal. For a systematic approach, follow the compliance audit framework in our guide to maximizing app metadata.

2. Signal Compliance in Your Store Listing

Apps that visibly demonstrate privacy-first practices — in their descriptions, screenshots, and feature highlights — build user trust and can capture search traffic for terms like "privacy," "secure," and "data protection." This is especially relevant as competition on Google Play intensifies and differentiation becomes harder.

3. Monitor Enforcement Waves

Policy updates are typically followed by batch enforcement cycles. As documented in our analysis of Google Play's ranking and engagement metrics, removal spikes routinely exceed 4,000 apps in a single day during enforcement periods. Tracking these waves helps you anticipate risk and verify your own compliance posture.

4. Leverage Keyword Opportunities

Policy-driven changes create new keyword opportunities. Terms like "contact picker," "location privacy," "health data compliance," and "account transfer" are gaining search relevance. Integrate these naturally into your metadata strategy — for a complete framework, see our guide on enlarging app store search traffic through keyword research.

Compliance Deadline Summary

FAQs

What happens if my app doesn't comply with the new Contacts Permissions policy by the deadline?

Google enforces policy violations through a graduated process that can include warning notifications, listing suppression, and full app removal. For the Contacts Permissions policy, you have until May 15, 2026 (30 days from announcement) to update your app. Apps that continue to request broad contacts access without a justified use case will be subject to enforcement, which can include removal from Google Play.

Does the new location button replace all existing location permission methods?

No. The location button is the recommended minimum scope for apps that need one-time precise location access. Apps with legitimate needs for continuous or background location tracking can still request those permissions, but must justify the requirement through a formal developer declaration. The key change is that Google now expects developers to default to the least invasive option and only escalate when functionally necessary.

How does the Account Transfer policy affect app acquisitions and agency management?

All developer account transfers must go through the official Play Console "Transfer ownership" workflow, which includes a mandatory seven-day security hold. This means informal practices like sharing login credentials or selling accounts through third parties are explicitly prohibited. Agencies managing client accounts should ensure each account's ownership structure is clearly documented and compliant before the May 27, 2026 deadline.

My app uses Health Connect — what do I need to change?

Review the updated Health and Fitness data guidelines for Android 16's granular permissions and the newly supported high-sensitivity data types (Menstrual Cycle Phases, Alcohol Consumption, Symptoms). Ensure your app's Data Safety declarations and privacy policy accurately reflect which health data types you access. Critically, confirm that your app does not use sensitive health data for employment decisions, insurance eligibility determinations, or unauthorized social sharing — these are now explicitly prohibited.

Are the Photo/Video Permissions and Age-Restricted Content clarifications actually new requirements?

Google characterizes these as clarifications, not new policies, meaning enforcement standards haven't changed. However, the updated language may reveal nuances in how Google interprets existing rules. It's worth reviewing the clarified text to confirm your app's current approach aligns with Google's stated expectations — even if you believe you're already compliant.

How can I stay ahead of future Google Play policy changes?

Subscribe to the Google Play PolicyBytes Hub, attend Policy Webinars, and monitor your Play Console inbox for pre-enforcement warnings. Building a quarterly compliance audit cycle into your release process — reviewing your app against the latest Policy Center, Data Safety requirements, and metadata guidelines — is the most effective way to prevent surprises. Follow ASOWorld's App Store News for developer-friendly analysis of each policy update cycle.