They do today, back up to 2012-2013 they did not. Apps were also overly abusing it back then such as Path [1] and many others.
> The operator of the Path social networking app has agreed to settle Federal Trade Commission charges that it deceived users by collecting personal information from their mobile device address books without their knowledge and consent.
Android didn't really close/tighten permissions until 2014 with Android 4 Ice Cream.
> The operator of the Path social networking app has agreed to settle Federal Trade Commission charges that it deceived users by collecting personal information from their mobile device address books without their knowledge and consent.
Android didn't really close/tighten permissions until 2014 with Android 4 Ice Cream.
[1] https://www.ftc.gov/news-events/press-releases/2013/02/path-...