Introduction
Before Android 10, any app with the READ_EXTERNAL_STORAGE permission could access every photo, document, and download on your device. A flashlight app could read your camera roll. A wallpaper app could scan your Downloads folder. The file system was a free-for-all, and users had no idea.
Scoped Storage changed that. Introduced in Android 10 (2019) and made mandatory in Android 11 (2020), it restricted app access to the shared file system. Apps were limited to their own sandboxed directory and specific media collections accessed through the MediaStore API.
It was the biggest privacy change since runtime permissions — and the most controversial.
The Old Model: Open Season
Before Scoped Storage, the READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE permissions gave apps blanket access to /sdcard/. Every photo, video, document, download, and app data file was readable by any app with these permissions.
The permission model encouraged abuse:
- Data harvesting: Apps scanned storage for personal information, usage patterns, and device fingerprints.
- Malware: Ransomware could encrypt user files. Spyware could exfiltrate photos and documents.
- Clutter: Apps created folders and files everywhere. The storage root became a dumping ground.
Users consented to this at install time, but they didn’t understand what they were consenting to. “Storage permission” sounds benign. It isn’t.
The New Model: Scoped Access
Scoped Storage changed file access to a mediated model:
- App-specific storage: Each app has a private sandbox directory. No other app can access it. No permission required.
- Media collections: Shared photos, videos, and audio are accessed through the
MediaStoreAPI. Apps can read all media or only their own contributions. - Documents: The Storage Access Framework (SAF) provides a system file picker for document access. Users select specific files to share.
- Broad access restricted:
READ_EXTERNAL_STORAGEno longer grants access to everything. Apps that genuinely need broad file access must use SAF or request special permissions.
The Backlash
Developers hated Scoped Storage. File manager apps, backup tools, media editors, and file-sharing apps relied on broad file access. They argued that:
- Legitimate apps break: File managers couldn’t browse the file system. Backup apps couldn’t read arbitrary directories.
- Performance: MediaStore queries were slower than direct file access.
- Complexity: Migrating from
FileAPIs toMediaStoreand SAF was difficult.
Google responded by delaying mandatory enforcement. Android 10 (API 29) allowed apps to opt out. Android 11 (API 30) made Scoped Storage mandatory for apps targeting API 30+. Apps targeting older API levels could still use the old model.
The Resolution
Over time, Google provided more escape hatches:
MANAGE_EXTERNAL_STORAGE: A special permission for file managers, backup tools, and other apps with legitimate broad access needs. Requires Play Store review.- MediaStore improvements: Performance optimizations made MediaStore queries faster and more reliable.
- SAF improvements: The Storage Access Framework was extended to support more use cases.
Most apps adapted. The ones that needed broad access got special permissions. The ones that didn’t — the flashlight apps and wallpaper apps — lost access they never should have had.
The Impact
Scoped Storage changed Android’s privacy model. Apps could no longer silently vacuum up user data. The file system became private by default.
It wasn’t perfect. The transition was painful. Some legitimate apps still struggle with the new model. But the alternative — an open file system accessible to any app with a single permission — was indefensible.
Scoped Storage was the right thing, done the hard way.
References
- Scoped Storage technical documentation (developer.android.com)
- “Android 10: Scoped Storage” (Android Developers Blog, 2019)
- Storage Access Framework documentation
- MANAGE_EXTERNAL_STORAGE permission guidelines