diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index 97f62e8..63a34e8 100755
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -4470,7 +4470,7 @@
                                 .setMinSdkVersionForFine(Build.VERSION_CODES.Q)
                                 .build());
         if (locationResult != LocationAccessPolicy.LocationPermissionResult.ALLOWED) {
-            SecurityException e = checkNetworkRequestForSanitizedLocationAccess(request);
+            SecurityException e = checkNetworkRequestForSanitizedLocationAccess(request, subId);
             if (e != null) {
                 if (locationResult == LocationAccessPolicy.LocationPermissionResult.DENIED_HARD) {
                     throw e;
@@ -4493,11 +4493,16 @@
     }
 
     private SecurityException checkNetworkRequestForSanitizedLocationAccess(
-            NetworkScanRequest request) {
-        if (mApp.checkCallingOrSelfPermission(android.Manifest.permission.NETWORK_SCAN)
-                != PERMISSION_GRANTED) {
-            return new SecurityException("permission.NETWORK_SCAN is needed for network scans"
-                    + " without location access.");
+            NetworkScanRequest request, int subId) {
+        boolean hasCarrierPriv = getCarrierPrivilegeStatusForUid(subId, Binder.getCallingUid())
+                == TelephonyManager.CARRIER_PRIVILEGE_STATUS_HAS_ACCESS;
+        boolean hasNetworkScanPermission =
+                mApp.checkCallingOrSelfPermission(android.Manifest.permission.NETWORK_SCAN)
+                == PERMISSION_GRANTED;
+
+        if (!hasCarrierPriv && !hasNetworkScanPermission) {
+            return new SecurityException("permission.NETWORK_SCAN or carrier privileges is needed"
+                    + " for network scans without location access.");
         }
 
         if (request.getSpecifiers() != null && request.getSpecifiers().length > 0) {