Hi wondering if someone can answer this... Is it necessary to ask the user for permission before accessing a list of contacts on a native app.. see attached image for context.
2 Answers
Yes, it is necessary to ask permission when accessing native tools like contacts, camera, etc. It has been designed this way to protect the user from an application asking for or gaining access without their expressed consent.
Imagine if an app labeled that action with something that had nothing to do with accessing contacts and the user clicked on it. Without the device opening a dialog to ask permission the user wouldn't realize the app now has access to their contacts.
In your particular example, the user's action would be a demonstrated intent. This means the developer could use an Android intent rather than asking for permission. Meaning that your app will ask the contacts app to do the lookup and ask permission for you rather than your app gaining direct access to their contact API. Either way, a dialog will show asking for permission for the security reasons above. Here's a link with more information on intents
Apps must get permission to access private data (even if they are technically capable of getting it without asking).
You and those who work on your app may be trustworthy and only use the contact data for displaying a list, but this is not always the case.
When using Apple's CNContactPickerViewController from ContactsUI "The app using contact picker view does not need access to the user’s contacts and the user will not be prompted for “grant permission” access." because "The app has access only to the user’s final selection.". IMHO this is a great improvement in the process; the user and OS are giving your app permission to see the piece of private data you need, without you needing to ask them for broad access.
