I was reading this answer, and the first comment under it, and wondered if apps can bypass their own app permissions and just get whatever data they want from Google Play Services.

What got me started with this was when I removed a bunch of permissions from Google Play Services and I started getting a notification saying "Accupedo is having trouble with Google Play Services. Try again." Clicking this notification brings up a screen saying "This app won't work properly unless you allow Google Play Services' request to access the following: Calendar; Camera; Contacts; Microphone; Phone; SMS. To Continue, open Settings, then Permissions, and allow all listed items."

As I search on the web and this site, I see everyone, seemingly blindly, saying "Oh, just give Google Play Services all the permissions possible and don't question them." But why? The whole point of having control over app permissions is to have control. This advice is simply giving up and letting Google do whatever they want.

As a concrete example, this one app does not request app permissions to my contacts, microphone, sms, camera, etc. However, Google Play Services' notification makes me think that this app is trying to get my SMS and camera and microphone. Since a simple step-counting app has zero reason to know my contacts or have access to my mic or camera, I would really like to know if they are trying to bypass even requesting app permissions and just getting everything they want from Google Play Services. If this is not the case, why would Google Play Services be sending me this notice?

By the way, originally, it included in the Google Play Services notification's permission list "body sensors." Since this made sense for a step-counting app, I went to Google Play Services and turned on that one permission. Now, "body sensors" is no longer in the list. This lends support to my idea that Google Play Services is receiving a request specifically for access to my camera and microphone (and others) from Accupedo while Accupedo has no such permission requested in the app permissions.

To be clear, this post is not about Accupedo. This question is about whether or not apps in general can simply hide from the user that they are collecting certain data or accessing certain parts of my phone without my awareness by getting everything from Google Play Services.

Any insights would be greatly welcomed.

  • Even I have noticed something similar in the past and unfortunately I could do nothing about it. So, I installed an app (firstly the Google Pay; then another regional food delivery app). I denied SMS permission to both. because I prefer entering OTPs myself. Surprisingly, both apps got OTP from SMS without SMS permission. Realized that it given from Play Services because the same didn't happen when I removed permission from Play Services. So, I believe the answer to your question is a YES.
    – singhnsk
    Apr 27 '19 at 10:41
  • 3
    Just a short remark (not enough research for a full-fledged answer), but as an Android app developer, the answer is yes. And to confirm @singhnsk 's comment about SMS, that's actually what Google recommends to read SMS directly to the app, to prevent SMS permission being misused instead. However, I haven't researched much more what Play Services can do and their related permissions.
    – Andrew T.
    Apr 27 '19 at 14:29
  • 2
    @AndrewT. Interesting. I see in that link the technique you mention will give access to only SMS destined for that app (using reasonable criteria). So, going through Play Services to read SMS would not allow access to all SMS. So there is some safety there.
    – AndyRoid
    Apr 27 '19 at 19:58
  • There are still lots of questions about the aspects (other than SMS).
    – AndyRoid
    May 9 '19 at 16:37
  • Long story short - Android is a Google built OS and they have access to system privileges for Play Services and some other components. Play Services are meant to allow sanitized access to certain system features (location, geofences, SMS OTP auth and several others). If you don't trust Google to protect your data on device, then you have fundamentally chosen the wrong device and operating system - since they're the ones that have developed most of the code and have the ability to update root privileged parts of the OS.
    – Mavrik
    Jul 21 '19 at 13:52

Browse other questions tagged or ask your own question.