New READ_MEDIA_IMAGES and READ_MEDIA_VIDEO Android policy

[mvl22]

Updated policy notified to us:

Last October, we introduced the Photo and Video Permissions policy to reduce the number of apps permitted to request broad photo/video permissions (READ_MEDIA_IMAGES and READ_MEDIA_VIDEO). To give developers more time to adopt these changes, we are extending the deadlines. Starting January 22, 2025, apps may only access photos and videos for purposes directly related to app functionality. Apps that need additional time may request extensions until May 28, 2025. Apps that have a one-time or infrequent need to access these files are requested to use a system picker, such as the Android photo picker. See Details on Google Play's Photo and Video Permissions policy.

Are we using a 'system picker'?

[jezhiggins]

Yes, we are. We use the system provided facilities for both taking new photos, and picking an existing photo.

[mvl22]

We have again got a message about this:

In October 2023, we announced the Photo and Video Permissions policy to  
enhance user privacy by limiting the number of apps with access to broad  
photo and video permissions (READ_MEDIA_IMAGES and READ_MEDIA_VIDEO).  
Starting January 22, 2025, your app must comply with this policy.

[ACTION REQUIRED] To ensure your app remains available on Google Play, you  
must take one of the following actions before January 22, 2025:



Declare your app's need for broad access: If your app's core functionality  
requires broad access to photos and videos, you can submit a declaration  
for review in Play Console. We will evaluate your request to determine if  
your use case is approved.
Remove the READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions from your  
app: If your app only needs occasional access to photos and videos, remove  
the READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions from all version  
codes within the submission. This includes both production and testing  
tracks. You can migrate to a system photo picker, which allows users to  
selectively grant access to specific media on a one-time or infrequent  
basis.
Request an extension: If you need more time to comply and have not yet  
completed the declaration, you can request an extension in Play Console  
until May 28, 2025. This will give you additional time to implement one of  
the above options. The extension request form takes approximately one  
minute to complete. For more information on how to extend, please refer to  
this guidance.
We strongly recommend taking action as soon as possible to avoid any  
disruption to your app's availability on Google Play.

For more information about the Photo and Video Permissions policy, please  
refer to this Help Center article.

[mvl22]

Remove the READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions from your
app

I note that we still do have READ_MEDIA_IMAGES listed:

https://github.com/search?q=repo%3Acyclestreets%2Fandroid%20READ_MEDIA_IMAGES&type=code

@jezhiggins Are these a problem?

[mvl22]

Update on this policy:

https://support.google.com/googleplay/android-developer/answer/14115180?hl=en-GB

We received an e-mail about policy changes, noting the following:

Apps can now only access photos and videos for purposes directly related to app functionality as stated in our Photo and Video Permissions policy. Apps that require these permissions may request an extension and submit a declaration form in Play Console on the app content page by May 28, 2025.

@jezhiggins Could you double-check on the system picker stuff? We definitely have READ_MEDIA_IMAGES still listed. It sounds as if the use of the system picker removes the need for this.

[jezhiggins]

Had yet another look at this. We were, and always, have been using the system photo picker. However, the API they want us to use has changed - rather than requesting the permissions and launching a system provided Intent, we now call a MediaPicker API. Presumably inside that they're managing the permissions ever so slightly differently.

From a user point of view, it looks exactly the same. Curiously there doesn't seem to be an equivalent Camera API.

[jezhiggins]

@mvl22 In the course of testing this, I uploaded a couple of photos at around 22:00 this evening. The upload succeeded but the backend wasn't able to process them. Can you have a poke in the logs and see if you can see what's happening there, in case I have to adjust anything on this end. Thanks

[mvl22]

Could you check you are definitely logged in? I met a user 2 weeks ago that appeared to be logged in but the submission didn't actually send username/password. I will create a separate issue on this - there's definitely a bug.

[mvl22]

Found the log entry.

The call was:

POST /v2/photomap.add?key=...

and we logged that the userid was empty at the point of entering the database.

The data attempted to be loaded into the database was:

latitude: 52.00834405070422
longitude: -4.90814208984375
datetime: '2025-05-20 22:14:14'
caption: Test
width: 750
height: 417
categoryId: 'cycleparking'
metacategoryId: 'bad'
userid: NULL
hasPhoto: 'yes'
license: 'cc-by-sa'

I will see if I can work out whether the userid NULL issue is being caused at our end or not being sent from the app.

(Note: log entry: 5103346, error code: 222, time: 2025-05-20 22:16:45. Also a similar case at 5091872.)

[mvl22]

The upload succeeded but the backend wasn't able to process them. Can you have a poke in the logs and see if you can see what's happening there, in case I have to adjust anything on this end.

@jezhiggins This is failing due to the issue in #570.

[mvl22]

We have now more explicit detection of a zero-length username/password, so the API now returns:

There was a problem uploading your photo:
A username and password must both be supplied.

#570 needs to be solved first therefore.

[mvl22]

The app is now live it seems.

@jezhiggins I see we still have one mention of READ_MEDIA_IMAGES:

https://github.com/cyclestreets/android/blob/master/libraries/cyclestreets-view/src/main/java/net/cyclestreets/util/Permissions.kt#L172

Is that correct?