Android 18 finally shuts the contacts back door, and it's overdue

Why did it take this long for any app on your phone to stop being able to rewrite your address book? That is the uncomfortable question behind Android 18's new contacts rules, and it deserves a straight answer: because nobody was forced to care.

What changes

According to nau.ch, apps that target the new OS version will no longer be able to change saved contacts directly through the old WRITE_CONTACTS permission. As heise summarizes it, most apps won't be allowed to write straight into contact data anymore.

There is an escape hatch for apps that genuinely need bulk editing. BornCity reports a new MANAGE_CONTACTS permission for contact managers, dialers, spam filters, and backup and sync services, plus transition periods. Android Authority says the new permissions begin arriving with Android 17 QPR2.

A blanket permission was always a bad deal

Let's be blunt: handing an app "write contacts" so it can add one number was like giving a courier the keys to your house because they needed to drop off a parcel. The permission was coarse, and coarse permissions get abused or exploited. A compromised or sloppy app could alter entries in the background, which is exactly the kind of manipulation the new rules are meant to block. In our view, the scam angle is the right lens here: swap a bank's number or a relative's name for something else, and a trusted address book becomes an attack surface.

This is the kind of fix that looks boring and matters a lot. It won't make headlines like a new AI feature. But it removes a quiet, long-standing assumption: that anything with a contacts toggle can scribble in your most personal database.

It should have come years ago. As t3n notes, apps have until now had nearly full access to the contacts in your address book. We think that says a lot about how normalized the overreach had become.

The test is what big apps do next

A permission change is only as good as developer behavior. There are two ways this can go. Big apps can adopt narrower flows, where you pick or confirm a specific change, and the address book stays yours. Or they can lean on the exemption category, or design prompts that make "allow" feel mandatory, and users click through out of habit.

We think the second risk is real. Users have been trained for years to tap "Allow" to get a feature working. If the dominant apps treat the new rules as friction to route around, the privacy gain shrinks to near zero. It's also worth noting the restriction applies to apps targeting Android 18, so the effect will arrive in step with developers updating, not on day one. The transition periods BornCity mentions cut both ways: sensible for compatibility, but also a window where old behavior lingers.

Who wins? Users who rarely think about permissions, and honest developers who only needed a narrow edit. Who loses? Apps that quietly hoarded write access "just in case", and anyone relying on it for growth hacks or contact syncing they never clearly disclosed. We would also expect some friction for smaller developers, who now have to rethink flows they built on a permission that used to be a free pass.

What to do

For now, nothing dramatic. When Android 18 reaches your phone, treat any app that asks for broad contact management as a red flag unless it is plainly a dialer, backup or spam-blocking tool. Review which apps already have contacts access in your settings; Google's support page on app permissions shows how to change what each app can use.

Verdict: a good, overdue move from Google. We'll judge it not by the announcement, but by how many popular apps ask for the special permission a year from now.