Android apps that get permission to change your contacts can currently access all of them. Google is interested in limiting that with a system that distinguishes between individual and bulk edits. The first components are arriving with Android 17 QPR2 later this year, according to an update highlighted by Google's Mishaal Rahman on X and detailed in a developer blog post.

The permission gap: one change can mean all contacts

Keeping Android users safe is one of the most challenging problems Google faces with its mobile operating system. Android's permission system is one way the company addresses that task: by granting apps only a narrow set of permissions they truly need, it can limit the ability of secretly malicious or otherwise compromised apps to do harm.

The contacts permission does not fit that model well today. An app that just wants to add or update one contact gets the same WRITE_CONTACTS permission that an app that wanted to change all of your contacts would. That lack of granularity means a permission designed for a simple, limited task can expose a much broader set of contact data.

What Android 17 QPR2 introduces

Google's upcoming change is aimed at separating the permission behavior for individual edits from permission behavior for bulk edits. The first components are arriving with Android 17 QPR2 later this year. The developer blog post provides further detail, while Rahman's X post highlights the shift.

What this means for readers

For Android users, the important detail is that the current contacts permission can be too broad: an app allowed to change contacts may be able to access all contacts, not just the one it needs to edit. If Google's distinction between individual and bulk edits takes hold, apps that perform narrow contact tasks may not automatically receive the same level of access as apps that modify many contacts.

For developers, the change suggests that WRITE_CONTACTS may need to be understood less as a single all-or-nothing grant and more as a permission whose impact depends on the type of contact operation. The exact effect will become clearer as Android 17 QPR2 arrives later this year and as the first components are detailed in Google's developer guidance.