Why does my app say I am requesting permission for Contacts?

Question

I have a watch face app that says I am requesting permissions for Contacts... but I'm not. I can't figure out why this is...

I have in-app billing and I access Google fit data... as well as Google Analytics.

Here is a list of the permissions in my manifest:

<!-- Normal Permissions -->
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
    <uses-permission android:name="com.android.vending.BILLING" />

    <!-- Dangerous Permissions -->
    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
    <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />
    <uses-permission android:name="android.permission.READ_INTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />

    <!-- Permissions required by the wearable app -->
    <uses-permission android:name="com.google.android.permission.PROVIDE_BACKGROUND" />
    <uses-permission android:name="android.permission.WAKE_LOCK" />

Here is a list from the Play store of the permissions for this app:

In-app purchases
Identity
find accounts on the device
Contacts
find accounts on the device
Location
precise location (GPS and network-based)
approximate location (network-based)
Photos/Media/Files
modify or delete the contents of your USB storage
read the contents of your USB storage
Storage
modify or delete the contents of your USB storage
read the contents of your USB storage
Other
receive data from Internet
full network access
view network connections
run at startup
prevent device from sleeping
use accounts on the device

App Dependencies:

dependencies {
    compile fileTree(include: ['*.jar'], dir: 'libs')
    wearApp project(':Wearable')
    testCompile 'junit:junit:4.12'
    compile 'com.google.android.support:wearable:1.3.0'
    compile 'com.google.android.gms:play-services:8.3.0'
    compile 'com.android.support:appcompat-v7:23.1.1'
    compile 'com.android.support:design:23.1.1'
    compile 'com.google.android.gms:play-services-analytics:8.3.0'
    compile files('libs/httpclient-4.5.1.jar')
    compile files('libs/apache-httpcomponents-httpclient.jar')
    compile files('libs/apache-httpcomponents-httpclient-cache.jar')
    compile files('libs/apache-httpcomponents-httpcore.jar')
    compile files('libs/apache-httpcomponents-httpmime.jar')
    compile files('libs/GoogleConversionTrackingSdk-2.2.4.jar')
    compile files('libs/feedback_v6.jar')
}

Wear Dependencies:

dependencies {
    compile 'com.google.android.support:wearable:1.3.0'
    compile 'com.google.android.gms:play-services:8.3.0'
    compile 'com.android.support:support-v13:23.1.0'
    compile 'com.google.android.gms:play-services-analytics:8.3.0'
}

Answer 1

In one of my apps, I faced an issue where I had my app asking for permissions which I never asked for, the reason for that turned out to be the Google play services.

We have to explicitly mention what part of Google play services we need for our app. For example, if we need ads, we need to use

com.google.android.gms:play-services-ads:8.4.0

and not

com.google.android.gms:play-services:8.4.0

what happens is then Google play services will ask permission for all the services it caters to even if our app does not require the same.

Please check, https://developers.google.com/android/guides/setup#add_google_play_services_to_your_project and use only what you need and see if that resolves your problem.

In your case I suspect, Google Account Login as the reason for contacts.

Hope this helps. All the best.

Answer 2

Great suggestion from @Natarajan Raman!! I just want to add there is a great article from @CommonsWare, Hey, Where Did These Permissions Come From? explaining this issue.

Quoting from the article:

It is possible that you will find yourself in a situation where you want a dependency but you don’t want the permissions that the dependency wants. You can try to block the permission from the merger process, by having a element in your own manifest (e.g., in the main sourceset) with tools:node="remove":

So if you only face issues with Contacts permission you could add in your Manifest:

 <uses-permission android:name="android.permission.READ_CONTACTS" tools:node="remove" />

And the unwanted permission will be removed.

Hope this helps!!!