Google Play Policy Ends Call Log Use for Flash Call Checks

A Google Play policy update announced on October 29, 2026 removes account verification via phone call from the permitted uses of the READ_CALL_LOG permission, effective January 27, 2027. Android apps that verify users with automatic flash calls will need to move to alternatives such as the SMS Retriever API or the Digital Credentials API.

What the October 29, 2026 Google Play update contains

Google published the Play Console policy announcement on October 29, 2026. It bundles several new rules, and developers have at least 30 days from that date to update their apps unless a specific rule sets a different deadline.

Three changes matter most for apps distributed in Indonesia, and all of them involve sensitive permissions. Phone call verification no longer justifies reading the call log. The local network permission is restricted for apps targeting Android 17 (API level 37) and higher. Google also restated that access to contacts and precise location must be explained through declaration forms in Play Console.

The same announcement reminds developers that, starting in November 2026, they must declare their trader status in Play Console under new requirements. The page does not describe those requirements in detail, so teams should check the notices in their own Play Console accounts.

Phone call verification loses access to the call log

According to Google’s policy page on SMS and call log permissions, Google Play will stop permitting account verification via phone call as a use case for READ_CALL_LOG from January 27, 2027. Until now, the method appeared in the exceptions table, described as verifying a device by transmitting a phone call.

How flash call verification works

In Indonesia the method is widely known as “OTP miscall”. Communications provider Infobip describes the flow: the user enters a phone number, a server places a very short call to that number and hangs up, and the verification code is drawn from some of the digits of the incoming number. The user never has to answer.

On Android, the app can complete the last step on its own by reading the call log and matching the incoming number against the numbers the server knows. Reading the log requires READ_CALL_LOG, and that is the step Google will no longer allow for verification.

The rule targets automatic access to the call log. Google’s documents do not address schemes in which users type the digits themselves, since those do not need the call log permission.

The replacements Google recommends

Google points developers to two main paths. The SMS Retriever API reads a one-time code from a text message automatically without extra app permissions, provided the message includes the code and a hash that identifies the app. When the SMS format cannot be changed to include that hash, Google recommends the SMS User Consent API, which asks the user to grant access to the content of a single message.

The second path is phone number verification through the Digital Credentials API. The app requests a digital token through Credential Manager, the user approves a system bottom sheet, and a token retrieved from the mobile carrier by authenticating the SIM is sent to the app’s server. The server exchanges it with a cellular aggregator or carrier endpoint for the verified number. Google says telephony charges apply at that exchange step.

Narrow exceptions remain. Government apps or authorized mobile network operator apps that collect or report telecommunications performance data can still request READ_CALL_LOG. Backup and restore apps can also apply, as long as they can restore data to the device’s original default phone or SMS handler.

Local network and contacts rules for Android 17 apps

The second change affects apps that talk to devices on the same network, such as security camera viewers, printer utilities and smart home controllers. Under Google Play’s guidance on restricted permissions, apps targeting Android 17 or higher may request ACCESS_LOCAL_NETWORK only when it is needed for core functionality and a device picker such as NsdManager is not sufficient.

The declaration form lists four use cases: peer-to-peer interaction, smart device and IoT control, network infrastructure and diagnostics, and media casting. Apps targeting Android 16 and lower keep local network access through the INTERNET permission as before.

For contacts, a rule first announced on April 15, 2026 says apps targeting API level 37 or higher may request READ_CONTACTS only when the Android Contact Picker cannot serve their core functionality. MANAGE_CONTACTS is reserved for apps whose core purpose is managing contacts in bulk. For location, apps holding ACCESS_FINE_LOCATION must explain why approximate location or the Android location button is not enough.

The deadlines are staggered. The call log, READ_CONTACTS and location rules become mandatory on January 27, 2027. Prompts for the local network declaration will appear in Play Console in June 2027, with compliance due by August 25, 2027. For both the contacts and local network rules, Google offers a 30-day automatic self-extension in Play Console. Private apps and enterprise device management apps are exempt from those two rules.

What this means for app development teams

The apps with the least time to spare are those that use a phone number as the key to an account: e-wallets, online lending, cooperative and credit union apps, and public service apps. Roughly two and a half months remain, and replacing a verification method touches the backend, the contract with the OTP provider and the sign-up flow at the same time.

Steps teams can start this week:

1. Audit the manifest and dependencies. Look for READ_CALL_LOG, READ_CONTACTS, ACCESS_FINE_LOCATION and the local network permission, including any brought in by third-party SDKs.
2. Ask the OTP provider for its plan. If a vendor supplies flash call verification, request its timeline for moving to SMS Retriever or carrier-based verification, and confirm the per-verification cost of the replacement.
3. Keep a fallback path. Carrier-based verification depends on support from carriers and aggregators, so an SMS OTP flow with SMS Retriever is still worth keeping.
4. Test local network features. For IoT apps, check whether NsdManager is sufficient before filing an ACCESS_LOCAL_NETWORK declaration ahead of August 2027.

Financial institutions should bring their risk teams into this discussion, because the verification method shapes how well an app resists account takeover. Google describes Digital Credentials verification as phishing-resistant compared with SMS one-time codes, although that claim has not been independently tested on Indonesian carrier networks. The deadline is also a good reason to review the sign-in and account recovery flow of digital financial services apps.

For developers of connected devices, the local network rule leaves more time, but the design decision is better made now. An app that only needs to find a single device on a home or office network can probably rely on the system picker, while network diagnostics tools or apps that control many IoT devices will need a core functionality case for their declaration.

Teams building Android apps from scratch can design verification flows that avoid sensitive permissions from the start. Merakit supports this kind of work through its mobile app development service, from permission audits to verification flow migration.

Frequently asked questions

Is OTP by missed call banned outright?

The Google Play policy governs app access to the call log. From January 27, 2027, apps can no longer use READ_CALL_LOG to read the caller’s number for account verification. Schemes where users type the digits themselves are not covered in the documents.

What does Google recommend instead of flash call verification?

Google recommends the Digital Credentials API for carrier-based phone number verification, or the SMS Retriever API to read SMS codes without extra permissions. The SMS User Consent API has also been added as a privacy-preserving alternative when the SMS format cannot be changed.

When does the Android 17 local network permission rule take effect?

Apps targeting Android 17 (API level 37) or higher must submit a Play Console declaration for ACCESS_LOCAL_NETWORK by August 25, 2027. Declaration prompts start appearing in Play Console in June 2027, and a 30-day automatic extension is available.

Closing thoughts

This Google Play update extends the same principle to the call log, contacts, location and the local network. Sensitive permissions are granted only for core functionality, while other needs are routed to system pickers or narrower APIs. Automatic flash call verification is the most immediate casualty because its deadline is close. If your team needs to map app permissions or redesign its verification flow before January 27, 2027, the Merakit team is ready to talk.

Sources

• Google Play Console Help: Policy announcement, October 29, 2026
• Google Play Console Help: Policy Deadlines (accessed November 8, 2026)
• Google Play Console Help: Use of SMS or Call Log permission groups (accessed November 8, 2026)
• Google Play Console Help: Understanding Restricted Permissions with minimum scope alternatives (accessed November 8, 2026)
• Android Developers: Phone number verification with Digital Credentials (accessed November 8, 2026)
• Google for Developers: SMS Retriever API overview (accessed November 8, 2026)
• Infobip: What are flash calls and are they a valid verification method? (accessed November 8, 2026)