Why has the READ_PHONE_STATE permission been added?

I eventually found this, which reports the same issue. One workaround is mentioned in Answer #3, which is to remove the permission "manually" (my assumption is that the permission is only required for very early Android versions, which is OK for me since my minSdk is 16):

<manifest ...    xmlns:tools="http://schemas.android.com/tools"    ... ><uses-permission    android:name="android.permission.READ_PHONE_STATE"    tools:node="remove" />

This issue is present in Play Services v 12.0.0 as well. There's an open issue tracker on it here. It seems the issue is present for both permissions:

• android.permission.READ_PHONE_STATE
• android.permission.WRITE_EXTERNAL_STORAGE

It will probably be fixed with 12.0.1 as we saw with the 10.0.1 fix (from the original question).

Until then, I recommend removing the permission manually from the manifest as stated in the answer by drmrbrewer.

Update
12.0.1 has been released as of March 28, 2018, where this issue was addressed.See the release notes here.

Adds missing minSdkVersion in -license artifacts to prevent automatic inclusion of READ_PHONE_STATE and READ_EXTERNAL_STORAGE permissions.

Update #2: Version 10.0.1 fixes the issue again.

Update: this also occurs in version 10.0.0 of Google Play services, as reported in this post.

Previous Answer:

Per this post in the Android Developers G+ Community, one of the moderators (me) posted this comment:

I already reported this issue internally yesterday when a developer pointed it out, the fix has already been made internally, and an updated SDK is coming soon

And the updated SDK is now available - use the 9.6.1 Google Play services dependency.