One of the highlight features of Android 13 is the Photo Picker, a new system component that lets users pick which photos and videos to give an app access to. Apps don’t need to request any permissions to get access to items the user selects via the Photo Picker, making it a privacy-preserving way to share photos and videos with apps. The system file picker that’s been around since Android 4.4 offers more functionality than the Photo Picker, but its UI is dated in comparison.
The Photo Picker (and the system file picker before it) protects your privacy by letting you restrict what photos and videos an app has access to. Unfortunately, many apps don’t support the Photo Picker, even though a backward compatible version of it is available for Android 4.4+. Apps have to specifically invoke the Photo Picker using an intent, but many apps choose not to use it for one reason or another. Fortunately, that might not matter anymore in Android 14, which is testing a way for users to pick which photos and videos apps can access through the Photo Picker regardless of whether or not those apps actually use the API.
Many apps access media files through the media store API. The system indexes files by their type, called media store collections, and maintains a database that apps can query using the media store API. Apps that use the media store API don’t need to ask for permission to read or modify files they own, but they do need to be granted permission by the user to access files owned by other apps.
Starting in Android 10, apps that target API level 29 or higher had to be granted the READ_EXTERNAL_STORAGE permission by the user before they could use the media store API to access files owned by other apps. In Android 13, the READ_EXTERNAL_STORAGE permission was split into three different permissions (READ_MEDIA_AUDIO, READ_MEDIA_VIDEO, and READ_MEDIA_IMAGES) that each grant an app targeting API level 33 the ability to use the media store API to access audio, video, and image files respectively that are owned by other apps.
Android 14 changes media access permissions once again by combining READ_MEDIA_VIDEO, READ_MEDIA_IMAGES, and ACCESS_MEDIA_LOCATION into a new permission called READ_MEDIA_VISUAL_USER_SELECTED. This permission allows an app targeting API level 34 to “read user selected image and video files from shared storage,” according to its description. However, Android 14 may retroactively apply this new behavior to existing apps that target API level 33 (ie. Android 13) and request READ_MEDIA_VIDEO or READ_MEDIA_IMAGES.
When an app that targets API level 33 triggers the runtime permission dialog to ask the user to grant them READ_MEDIA_VIDEO or READ_MEDIA_IMAGES (or both), Android 14 may insert a new entry in the permission dialog that says “Select Photos.” Tapping this entry will launch a new version of the Photo Picker that allows the user to select which photos or videos they want to grant the app access to. The app subsequently has access to only those media items that the user specifically selected, unless the user chooses to expand access to additional media items or grant the app access to the entire media store collections for images and videos.
This entry in the permission dialog isn’t shown by default in Android 14 DP1, as its visibility is gated by a developer flag that I had to toggle. If this feature makes it to release, though, it’ll be a major win for privacy, as it means that users will always have the ability to decide which photos or videos an app should have access to.
Far too few apps use the Photo Picker API as it is, prompting Google to experiment with intercepting an existing intent that apps use to launch the system file picker so that they instead launch the Photo Picker. While the Photo Picker has some flaws, such as not showing files from cloud media providers yet (perhaps it will soon with extension SDK version 5!) and only showing certain albums on the device, it’s better than the old system file picker and is certainly preferable to every app having access to every photo and video in the gallery.
Developers who are interested in implementing the Photo Picker API should upgrade to the latest version of the Jetpack Activity library, which handles calling the backward-compatible version provided through Google Play Services on Android 4.4-Android 10 or the framework-provided version provided through the MediaProvider Mainline module.