Sandboxed Google Play receives no special access at all, so you can deny it all permissions if you want, but you should grant network (and maybe notifications) permission for it to actually function.

https://grapheneos.org/features#sandboxed-google-play

▲

bornfreddy 2 hours ago | parent [-]

Well that's a bit misleading answer. Some apps refuse to work if G services are disabled, so they clearly communicate with them. It would be nice to know what exactly G learned about the phone through those "sandboxed" apps.

	▲	palata an hour ago \| parent [-]
		I denied the contacts permission to the Play Services. It just shows a notification when it tries to access them, which is actually not common at all.