Key points:
- Google’s July 15, 2026 policy update tightens rules for anonymous and random chat apps under its Families Policy and Child Safety Standards.
- The SMS and Call Log Permissions policy drops phone-call account verification as an allowed use for READ_CALL_LOG. The Digital Credentials API or SMS Retriever API are the stated alternatives.
- User data rules, limited use, disclosure, and consent, now explicitly cover third-party AI integrations too. Not just a developer’s own systems.
- Developers get at least 30 days from July 15, 2026 to bring apps into line.
One policy update. Three separate things. Chat safety. A specific Android permission. AI data handling. Easy to skim past in one pass. Each piece carries its own real deadline. Here’s what Google’s July 2026 update actually asks for, piece by piece.
Anonymous and random chat apps
Google’s update adds rules here. Under its Families Policy. Under its Child Safety Standards. Aimed straight at anonymous chat and random chat apps. The direction fits Google’s wider child-safety push this year. These apps can’t target children now. New rules stack on top of Google’s existing age-restricted content policy. Got a chat feature that pairs up strangers, even as a small side feature? Worth a direct check. Don’t assume this only touches apps built purely for chat.
The Call Log permission change
This is the sharpest, most technical piece. The SMS and Call Log Permissions policy no longer allows account verification via phone call as a valid reason for READ_CALL_LOG. Request that permission just to confirm a user’s identity through an incoming call? That reason no longer holds up.
| Old approach | What Google points to instead |
|---|---|
| READ_CALL_LOG for phone-call verification | No longer an allowed use case |
| Alternative 1 | Digital Credentials API |
| Alternative 2 | SMS Retriever API |
Both alternatives verify a user without the wide access READ_CALL_LOG grants. That’s the real point here. Narrower permission. Same result.
Third-party AI and your data duties
Google’s update closes a gap too. Some developers may have assumed it was open. User data rules apply here now. Limited use. Real disclosure. Real consent. They cover a third-party AI provider doing the work. Not just a developer handling data directly. Send user data through an outside AI tool, and the job doesn’t move with it. It stays with you.
Real-world scenario: A messaging app used READ_CALL_LOG for years, purely to confirm a new user’s phone number matched a recent incoming call. A quick verification shortcut, nothing more. Reading Google’s updated policy directly showed that exact use case was gone. The team swapped it for the SMS Retriever API. Users got verified through an incoming text instead of call history. No broad permission needed at all. The new flow ended up simpler for users too. Not just more compliant.
What to actually do about it
- Audit any chat feature that pairs strangers, not just apps built entirely around chat. Google’s rule targets the behavior. Not just apps labeled as chat apps.
- Check whether you request READ_CALL_LOG for account verification. If so, that reason is gone now. Move to the Digital Credentials API or SMS Retriever API before enforcement catches up.
- Review every third-party AI integration for real data compliance. Limited use, disclosure, consent. All apply there now, just as much as your own systems.
- Count your compliance window from July 15, 2026. Not from today. Reporting says at least 30 days from that date. Check how much runway you have left.
AppRankr’s Rank Tracker tracks your real Google Play visibility. But a policy violation here can hurt your app’s standing before it ever shows up as a rank change. Check compliance against Google’s own current pages. Not a summary written before enforcement details settled.