Short answer
Find every feature that reads contacts. If the user only picks one or a few contacts, such as to invite, share or pay someone, switch to the Contact Picker with Intent.ACTION_PICK_CONTACTS and remove READ_CONTACTS from the manifest. Keep the permission only for core features such as contact management or backup, and explain in the Play Console declaration why the picker is not enough.
Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
Why Google Play flags READ_CONTACTS, and the fix
01
The app reads all contacts to invite or share
“only request the READ_CONTACTS permission for sharing files, collaborating, inviting/referring someone to join a service, choosing a contact to transact with, typically should not request the permission.” Google Play, Contacts Permission (FAQ)
Inviting a friend, sharing a file or picking someone to pay only needs the contacts the user chooses. Google says these apps typically should not request the permission, so use the Contact Picker instead.
02
The app keeps the permission with no declaration
“may only request the READ_CONTACTS permission if the Android Contact Picker is not sufficient for your app to provide core functionality.” Google Play, Contacts Permission
Apps that carry READ_CONTACTS are asked in Play Console either to submit a declaration or to remove the permission. After the compliance date, apps that target Android 17 or later and do not comply are subject to enforcement, and only apps that pass the access review keep the permission.
03
A custom contact list is treated as a reason
“This does not qualify as a reason to retain Contacts access.” Google Play, Contacts Permission (FAQ)
Building your own contact screen does not justify the permission. Google says a custom picker does not qualify, so replace it with the system Contact Picker.
04
A library adds the permission
Also check: an SDK or plugin can merge READ_CONTACTS into the final manifest even if your own code never asks for it. Open the merged manifest in the release build, and remove the permission with tools:node="remove" if no core feature needs it.
Checked against the vendor’s docs on : Google Play Help: Permissions and APIs that access sensitive information (Contacts Permission).
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”
Related: Google Play Photo and Video Permissions · Google Play SMS and Call Log permissions · Google Play Data safety form rejected · Google Play QUERY_ALL_PACKAGES