Android 17 QPR2 revamps contact handling – what the change means for your phone apps

A shift in how Android apps touch your address book

Google’s Android team announced a major change that will affect virtually every app that ever saved a phone number, email address or business card on your device. Starting with the Android 17 QPR2 release slated for the fourth quarter of 2026, the long‑standing WRITE_CONTACTS permission will no longer grant apps the ability to write directly to the contacts database. Instead, the system will force developers to use the standard contact intents – ACTION_INSERT, ACTION_EDIT and ACTION_INSERT_OR_EDIT – which present a built‑in editor UI and require no runtime permission.

The move is designed to curb the background “silent‑write” behaviour that many apps have relied on, while also ironing out the long‑standing inconsistencies between manufacturers’ contact editors. For users, the change promises a more predictable experience when an app asks to add a new friend, a business card, or a payment recipient.

Why Google is pulling the plug on WRITE_CONTACTS

Historically, an app that needed to store even a single contact would request the WRITE_CONTACTS permission. That permission, however, is broad – it lets the app add, modify or delete any contact on the device, often without any visible UI. In practice, many developers used it as a shortcut, bypassing the system’s contact editor entirely. The downside is two‑fold:

1. Privacy risk – an app could silently alter a user’s address book, potentially injecting spam or malicious entries.
2. Fragmented UI – OEMs implemented the contact editor differently, leading to missing fields, unexpected back‑button behaviour, or the inability to pre‑populate a photo.

Google’s blog post notes that “most apps don’t need such broad permission,” and the new policy forces a standardised, user‑visible workflow.

What developers must do now

Switch to contact intents

The recommended path is straightforward: replace any direct ContentResolver calls that touch ContactsContract.RawContacts or ContactsContract.Data with one of the three intents. The system will then display a half‑sheet editor for new contacts or a full‑page editor for existing ones, letting the user confirm the data before it is saved. Because the editor runs in the OS, the app no longer needs WRITE_CONTACTS and will not be blocked on Android 17 QPR2.

val intent = Intent(Intent.ACTION_INSERT, ContactsContract.Contacts.CONTENT_URI).apply {
    putExtra(ContactsContract.Intents.Insert.NAME, name)
    putExtra(ContactsContract.Intents.Insert.PHONE, phone)
    putExtra(ContactsContract.Intents.Insert.EXTRA_ACCOUNT, account) // new, now guaranteed
    putExtra(ContactsContract.Intents.Insert.EXTRA_PHOTO_URI, photoUri) // new in QPR2
    clipData = ClipData.newRawUri("", photoUri)
    addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
}
context.startActivity(intent)

Key extras that were previously spotty across devices are now standardised:

• EXTRA_ACCOUNT – tells the system which account (Google, Exchange, etc.) the contact should belong to.
• EXTRA_PHOTO_URI – lets the app pre‑fill a contact picture; the editor automatically handles the URI permission.

When you really need bulk access – MANAGE_CONTACTS

Google recognises that a small class of apps – such as enterprise CRM tools, cloud sync services, or full‑blown dialer replacements – still need to manage contacts without user interaction. For these cases a new special‑access permission called MANAGE_CONTACTS is introduced. It is not a runtime dialog; users enable it manually under Settings → Special app access → Manage contacts.

To publish an app that uses MANAGE_CONTACTS, developers must submit a Play Console declaration explaining why the standard intents are insufficient. The permission covers reading, creating, editing and deleting contacts, as well as interacting with the new People Directory – a system‑wide catalogue where apps can publish “Call with …” or “Message with …” actions without touching the user’s address book.

How the change affects everyday Android users

For the typical Android‑phone buyer, the impact will be subtle but positive:

• More transparent prompts – whenever an app wants to add a contact, you’ll see a familiar editor screen rather than a silent background write.
• Consistent UI across brands – Samsung, OnePlus, Pixel and others will now honour the same intent behaviour, meaning the photo you select and the fields you fill will appear reliably.
• Reduced spam contacts – apps can no longer surreptitiously bulk‑add marketing numbers; they must ask you each time.
• Faster onboarding for social and payment apps – the half‑sheet editor is designed for one‑tap saves, so adding a friend from a ride‑sharing app will feel snappier.

If you rely on a contact‑heavy app (e.g., a business‑card scanner or a corporate sync client), you may notice a settings entry asking you to grant Manage contacts access. This is expected and only required for apps whose core function is to keep your address book in sync.

Migration checklist for developers (and a quick guide for curious users)

1. Search your codebase for WRITE_CONTACTS, ContactsContract.RawContacts.CONTENT_URI, ContactsContract.Data.CONTENT_URI and any applyBatch calls.
2. Replace each user‑initiated write with the appropriate intent (ACTION_INSERT for new contacts, ACTION_EDIT or ACTION_INSERT_OR_EDIT for updates).
3. Add supported extras – EXTRA_ACCOUNT and the new EXTRA_PHOTO_URI – to improve the user experience.
4. If your app needs background sync, evaluate whether MANAGE_CONTACTS is truly required and prepare the Play Console declaration.
5. Remove WRITE_CONTACTS from the manifest once all paths have been converted.
6. Test on a device running Android 17 QPR2 – attempts to write directly should now throw a SecurityException.

For users who want to see whether an app still holds the old permission, you can check Settings → Apps → [App] → Permissions. If you see Contacts listed, the app may need to be updated by its developer.

Looking ahead – the People Directory

Alongside the contact‑intent overhaul, Google is rolling out a People Directory in the same QPR2 release. This system service lets apps publish “reachability” metadata (e.g., “Call with WhatsApp”) that appears in the native Phone and Contacts apps. By moving these actions out of the address book, developers can avoid the need for any contact‑write permission altogether. Early adopters include VoIP and messaging services that previously added custom rows to a user’s contact entry.

Bottom line for Android‑mobile shoppers

The upcoming Android update tightens privacy, streamlines the contact‑saving workflow, and gives power users a clear toggle for apps that truly need deep contact access. While the change is primarily a developer‑focused announcement, the ripple effect will be a cleaner, more predictable contact experience on the phones you buy – whether you’re on a contract with EE, a pay‑as‑you‑go deal with Three, or a refurbished device from a third‑party retailer.

Stay tuned for the official rollout date and keep your apps updated; the transition should be seamless for most popular apps, but legacy utilities may need a quick update from their developers.