One possibility is that Google Play runs the app in a sandbox, monkey test it by clicking on everything, trace the outgoing connections and sees that one request contains PII from the sandboxed contacts. It could be a third party library that does it.
Play is surprisingly sophisticated, and with Google focusing only on automation, i wouldn't be surprised to see them have this level of testing. This particular test wouldn't even be hard to write.
Play is surprisingly sophisticated, and with Google focusing only on automation, i wouldn't be surprised to see them have this level of testing. This particular test wouldn't even be hard to write.