With the new documentation of Android P, the description of WifiManager.startScan() (https://developer.android.com/reference/android/net/wifi/WifiManager.html#startScan()) says the following:

This method was deprecated in API level P.
The ability for apps to trigger scan requests will be removed in a future release.

It's not clear what your plans with app's access to surrounding wifi networks are - will there be a different API or do you plan to disallow accessing this information completely?

It's clear the current situation is quite a disaster from a privacy point of view. A year ago I submitted this issue:

https://issuetracker.google.com/issues/63125228

with no resolution as of now so in Android P developer preview apps using older Android API can still access the wifi network information and possibly obtain user's location based on that. On the other hand, my apps

https://play.google.com/store/apps/details?id=net.techet.netanalyzerlite.an&hl=en
https://play.google.com/store/apps/details?id=net.techet.netanalyzer.an&hl=en

use the new API and are required to have the location permission but it turns out to be super-confusing for users and I get lots of questions and bad ratings saying things like "Why does the app need GPS to show wifi networks?" (users don't really distinguish between GPS and location permission).

Finally, apps having the location permission for some other reason shouldn't have an automatic access to startScan() results because this is a completely different kind of information and this way apps can build offline databases of wifi hotspots even when they aren't network-related in any way.

So, clearly, the current situation is far from ideal but there are still legitimate uses of wifi signal scanning as users need to set up their home networks. In my opinion, there should be a new "scartScanV2()" API which requires:

1. A new runtime permission that would give users a message like "The app wants to access detailed information about neighboring wifi networks which can be used to obtain your location and for user tracking."

2. The permission could even be hidden somewhere in Android settings and users would have to navigate there manually to enable it - this would eliminate "newbies" permitting just about everything to enable it without understanding what they are doing.

3. For apps distributed through the Play Store you could check if they require this permission and if they do, add some additional dialog developers would have to confirm saying something like "I confirm that the app doesn't collect the data obtained by startScan() and that they don't leave the device. Violating this agreement will result in app's removal from the Play Store."

I really hope there will still be some startScan() alternative for network tools apps in post-P Android versions as this feature is really useful for end users and many users need it.

Issue 74882205

Mentioned issues (1)

Links (6)

Issue metadata