Common questions with Advanced Protection Program

Get answers to frequently asked questions or troubleshoot issues with the Advanced Protection Program.

Important: Due to COVID-19, we temporarily suspended enrollment with your phone’s built-in security key. You can still enroll with the 2 security keys you've purchased or join our waitlist to enroll with your phone’s built-in security key.

After you sign in with your password, both 2-Step Verification and Advanced Protection require a second step to verify it's you.

With 2-Step Verification, the second step could be a:

• Prompt sent to your phone
• Verification code
• Security key

With Advanced Protection, the second step is always a security key because it's a more secure way to sign in. 

Also, Advanced Protection limits third-party app access to your data, puts stronger checks on suspicious downloads, and tightens account recovery security to help prevent unauthorized access.

The Advanced Protection Program is a free service. However, you may need to purchase security keys.

Yes. If you are at high risk for targeted online attacks, we recommend that you enroll both your work and personal accounts.

• Add a recovery email and phone number to your Google Account to help you recover the account if you get locked out. 
• If you have an iPhone, make sure you have the Google Smart Lock app installed. You need this when you enroll.
• Turn on 2-Step Verification in your Google Account.
• Order one or more security keys, if you don’t already have them.

Yes, if your admin has enabled Advanced Protection. Check with them before you enroll. Your admin can also enroll all accounts in the organization.

Yes. We recommend that you enroll all accounts in any organization that might be targeted, like a political campaign team, an activist group, or your IT department.

A security key is a small device that connects to your devices either through USB ports or wirelessly via NFC or Bluetooth. Your phone may also have a built-in security key.

A security key helps protect your account from unauthorized access. When Advanced Protection is turned on, a security key that's been registered to your account is required to sign in.

Advanced Protection uses security keys because they’re a more secure second step for 2-Step Verification. You need a security key the first time you sign in to your Google Account on a new device.

Our research shows that security keys are more effective at stopping hackers than any other common methods.

We recommend a primary key and at least one backup key. Your primary key can be your phone’s built-in security key. For backup keys, Titan Security Keys can be purchased from Google, or you can use any FIDO-compliant key from another trusted retailer. Learn more about how to order security keys.

If you still have account access:

1. Get one or more replacement security keys.
2. Go to your Google Account.
3. On the left navigation panel, click Security.
4. In the Signing in to Google panel, click 2-Step Verification.
5. Click Add security key. Add your new security keys.
6. Next to the lost security key, select Edit Remove this key.

If you don't have account access:

1. Submit a request to recover your account. It takes a few days for Google to verify it’s you.
2. While you wait, order one or more replacement security keys.
3. You'll get an email to your recovery email address to let you know when you can access your account again. After you get that notification, sign in to your account.
4. Turn on Advanced Protection again.

You should keep your security key with you any time you might need to sign in on a new device.

If you travel, bring your security key with you. You should charge any Bluetooth security keys before you leave.

You can sign in to your Google Account on Google apps and with the Chrome browser on your computer and mobile web. You can't use your Google Account with some apps and services that require access to your emails and Google Drive data.

You can still sign into apps and services with Google. If they request access to your Gmail or Drive data, access is denied.

Tip: You can use an extra code to give some supported apps access to your Gmail or Drive data.

Yes, Nest works with Google Accounts, including accounts that are enrolled in the Advanced Protection Program. To help you manage all your Google Nest and Google Home devices, you can migrate your Nest Account to a Google Account.

For privacy-related info about Google Nest connected home devices and services, check these FAQs on privacy.

Share with other home members more securely

To help keep your Google Nest and Google Home devices secure, follow these tips:

1. Only add home members you trust. Keep in mind that:
   • Any home member can access devices, media services, addresses, and home activity.
   • Home members can add new devices to your home.
   • Home members can add or remove other home members, including you. Anytime a member is added to your home, all home members get an email notification.
2. If your Google Account is enrolled in Advanced Protection, we strongly recommend that all home members enroll in Advanced Protection. That way, all home members are equally protected against unauthorized access to their Google Account and home devices or services.

Most non-Google apps and services are blocked

Advanced Protection stops most non-Google apps and services from accessing data like your Google Drive and Gmail data. That way, your data is better protected against harmful or unsecure access.

After you turn on Advanced Protection, you can allow these apps and services to access your Google data:

• All Google apps and services
• Apple Mail, Calendar, and Contacts apps on iOS and macOS
• Mozilla Thunderbird
• Desktop email clients that access Gmail directly

Let non-Google Apps access your Google data

Apple apps on iOS

You can use a temporary code to let some Apple apps access your Gmail and some other Google Account data.

Mozilla Thunderbird

You can use Mozilla Thunderbird to access your Gmail. Make sure you’re using the latest version of Thunderbird (60.0 or up).

Apps Script may be blocked

If you're enrolled in Advanced Protection, Apps Script can be used. If scripts request access to certain data in your account, like emails, documents, or photos, they may be blocked.

You can use Advanced Protection with a Mac running macOS 10.5 or above. To add a security key, use the following steps:

1. On your computer, go to System Preferences.
2. Click Internet AccountGoogle.
3. Follow the instructions to sign in.

No. Apps that use App passwords instead of 2-Step Verification are blocked for users with Advanced Protection.

You might not be signed in to the Google Account that was invited to Advanced Protection.

If you’re signed in with multiple accounts, sign out of all other accounts. After you've set up Advanced Protection, you can sign back into your other accounts.

To register your Bluetooth key on your computer, use the USB cable to connect the key to your computer.

To set up a Security Key on a computer running a Linux-based operating system, you may need to add a new udev rule.

1. Go to this directory: /etc/udev/rules.d
2. Create a new file for your Security Key.
3. Name your file (for example: 70-key.rules).
4. In the new file, paste the instructions for your udev version. If you don’t know your udev version, run the command: sudo udevadm --version
   • Udev version 188 or higher:
     • KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="18d1|096e", ATTRS{idProduct}=="5026|0858|085b", TAG+="uaccess"
   • Udev version 187 or lower:
     • KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="5026", GROUP="plugdev", MODE="0660"
5. Save your file and run the command: sudo udevadm control --reload-rules

Restart your computer and Add a Security Key to your Google Account.

If Safe Browsing can’t confirm that a download is safe, Chrome warns you that the file could be harmful.

Continue a download that was blocked by Chrome

Important: To protect your account and sensitive data, do not download files you’re warned about unless you’re certain that they’re safe.

On the pop-up about the blocked download, select Up arrowKeep.

If a file is known to be harmful, Safe Browsing won’t allow you to download it.

On your Android phone or tablet, turn on Bluetooth. If your security key still won't connect, temporarily turn on Location Services when you use your security key.

When you try to sign in with your phone’s built-in security key, you may receive the message “Turn on Bluetooth to allow pairing." The notification may display even if you turned on Bluetooth on both your phone and Windows 10 device.

To allow your phone's built-in security key to connect to your Windows 10 device:

1. Open Windows 10: Settings  Privacy  Radios. 
2. Under "Allow apps to control device radios", turn on.

You can turn off Advanced Protection in your Google Account.

1. Go to the Security section of your Google Account using a device that’s already signed in.
2. Under "Advanced Protection Program," select Unenroll.
3. Follow the on-screen instructions to unenroll.

To sign in to your Android TV after you turn on Advanced Protection:

1. Remove your Google Account from your Android TV.
2. Add your Google Account to your Android TV again and choose the option to set up using a phone that's on the same Wi-Fi network.