Why does Android PlacePicker not(!) require ACCESS_FINE_LOCATION permission to work?

Question

The PlacePicker is a useful widget added in com.google.android.gms:play-services-places:9.4.0. Find the description here: PlacePicker

The documentation clearly states that you need the ACCESS_FINE_LOCATION permission for it to work.

On Marshmallow and above you also must ask the user to grant this permission.
But it seems to work without doing any of this!
My app does

• provide a maps API key
• not define the permission in the AndroidManifest
• not ask the user to grant this permission at any time

But running the app on an Marshmallow device DOES start the PlacePicker and I can

• correctly select a place (not possible without the API key).
• go to "My Location" via the MyLocation-Button (possible without API key)

Can anyone confirm this or has an explanation why this widget works without proper permissions granted?

Answer 1

The question is almost an year old but I was trying to find the same answer so it can help somebody else.

It's because PlacePicker works with "intent based request". The documentation is not very clear with it, but it says

1: Only use the permissions necessary for your app to work. Depending on how you are using the permissions, there may be another way to do what you need (system intents, identifiers, backgrounding for phone calls) without relying on access to sensitive information. Source

And give some clue here:

If your requirement for access to user data is infrequent — in other words, it's not unacceptably disruptive for the user to be presented with a runtime dialogue each time you need to access data — you can use an intent based request. Android provides some system intents that applications can use without requiring permissions because the user chooses what, if anything, to share with the app at the time the intent based request is issued. Source

I've figured it out testing permissions use cases with Marshmallow and Lollipop devices, comparing the result with PlacePicker that I thought could be using intent based permissions with MediaStore that use this kind of permission according to documentation:

For example, an intent action type of MediaStore.ACTION_IMAGE_CAPTURE or MediaStore.ACTION_VIDEO_CAPTURE can be used to capture images or videos without directly using the Camera object (or requiring the permission). In this case, the system intent will ask for the user’s permission on your behalf every time an image is captured. For example, an intent action type of MediaStore.ACTION_IMAGE_CAPTURE or MediaStore.ACTION_VIDEO_CAPTURE can be used to capture images or videos without directly using the Camera object (or requiring the permission). In this case, the system intent will ask for the user’s permission on your behalf every time an image is captured. Source