Why do some apps not have to ask for the "Draw over other apps" permission? In Android 6, Apps have to ask the user for the "Draw over other apps" permission, which is

android.permission.SYSTEM_ALERT_WINDOW 


However there are some notable exceptions that get this permission granted on install.
Examples are almost every Google app, like the Photos app. Being a Google OS, this makes makes sense (and they are probably in the /system partition), but the same also applies to Facebook and the FB Messenger apps, downloaded through the store.

How can this be? Does Facebook pay Google to be on some sort of whitelist for the permission? Doesn't this undermine the whole purpose of the permission system? 

Where are informations about whitelisted apps stored? Is it by certificate? 

Does something similar exist for other permissions, too?
Based on an answer by Mattia Maestrini on Stack Overflow,

It is a new behaviour introduced in Marshmallow 6.0.1.
Every app that requests the SYSTEM_ALERT_WINDOW permission and that is installed through the Play Store (version 6.0.5 or higher is required), will have granted the permission automatically.
If instead the app is sideloaded, the permission is not automatically granted. You can try to download and install the Evernote APK from apkmirror.com. As you can see you need to manually grant the permission in Settings -&gt; Apps -&gt; Draw over other apps.
These are the commits [1] [2] that allow the Play Store to give the automatic grant of the SYSTEM_ALERT_WINDOW permission.