[gabemart]

I also have an audio app with a background audio service on Google Play, and I also have to request the READ_PHONE_STATE permission. I have an explanation in my store listing but I still get emails about it every week.

It's totally nuts. Knowing the phone is ringing or off the hook should not be privileged information.

[dllthomas]

"Knowing the phone is ringing or off the hook should not be privileged information."

It seems like it could be a privacy concern. It seems a common enough need that it probably shouldn't be lumped together with other things, though.

[MichaelGG]

Could you elaborate how it's a privacy concern? I have to get pretty darn creative to come up with any scenarios.

[dllthomas]

What makes a privacy concern legitimate, to your mind? It's giving data about a person to a group that otherwise would not have had access to it. It seems first order a privacy concern.

There's also some possibility it could be turned into more sensitive data - if my app tends to be recommended around social circles, and I see two people were on the phone over the same period of time, it's likely they were talking.

[MichaelGG]

And if a service can reach out to the Internet, it knows my IP can tell where I am. And if it suddenly cuts out after being on a known IP, then maybe I'm going through a local tunnel.

That's what I meant by you have to get really creative to think how this could possibly be impacting. If you have a sandbox, you have to choose which permissions you're going to ask for carefully, to avoid overloading users.

Android made a bad decision by making phone apps needing permission to know if the phone is active, then compounded that by tying it into device ID and who you're calling.

[dllthomas]

"The privacy concerns are not significant enough to merit demanding permissions" is certainly a defensible position; I'm not sure whether I agree with it, but it's not crazy.

That is distinct, though, from "there is no privacy concern."