Changes are coming to this article
This article will be updated with recently announced changes.
To give developers more control over where their apps appear, we’re updating our Device and Network Abuse policy to state that all apps running On-device Android Containers, which simulate all or portions of the Android OS, must respect the new REQUIRE_SECURE_ENV flag. Apps can add this flag to their manifest to indicate they don't want to be run in an On-device Android Container. (effective January 31, 2024)
- For apps targeting Android 14 and above, a new set of policy restrictions will apply to the usage of foreground services (FGS). Apps can only declare foreground services (FGS) for appropriate use cases. Developers must also specify a valid foreground service type for each foreground service (FGS) used in your app, and declare the foreground service permission that is appropriate for that type.
- We’re introducing a new JobScheduler API and requirements that makes user-initiated data transfers easier and more transparent.
To preview the updated "Device and Network Abuse" article, visit this page.
We don’t allow apps that interfere with, disrupt, damage, or access in an unauthorized manner the user’s device, other devices or computers, servers, networks, application programming interfaces (APIs), or services, including but not limited to other apps on the device, any Google service, or an authorized carrier’s network.
Apps on Google Play must comply with the default Android system optimization requirements documented in the Core App Quality guidelines for Google Play.
We don’t allow code that introduces or exploits security vulnerabilities. Check out the App Security Improvement Program to find out about the most recent security issues flagged to developers.
- Apps that block or interfere with another app displaying ads.
- Game cheating apps that affect the gameplay of other apps.
- Apps that facilitate or provide instructions on how to hack services, software or hardware, or circumvent security protections.
- Apps that access or use a service or API in a manner that violates its terms of service.
- Apps that are not eligible for allowlisting and attempt to bypass system power management.
- Apps that facilitate proxy services to third parties may only do so in apps where that is the primary, user-facing core purpose of the app.
- Apps or third party code (for example, SDKs) that download executable code, such as dex files or native code, from a source other than Google Play.
- Apps that install other apps on a device without the user's prior consent.
- Apps that link to or facilitate the distribution or installation of malicious software.
Flag Secure Requirements
FLAG_SECURE is a display flag declared in an app’s code to indicate that its UI contains sensitive data intended to be limited to a secure surface while using the app. This flag is designed to prevent the data from appearing in screenshots or from being viewed on non-secure displays. Developers declare this flag when the app’s content should not be broadcast, viewed, or otherwise transmitted outside of the app or users’ device.
For security and privacy purposes, all apps distributed on Google Play are required to respect the FLAG_SECURE declaration of other apps. Meaning, apps must not facilitate or create workarounds to bypass the FLAG_SECURE settings in other apps.Apps that qualify as an Accessibility Tool are exempt from this requirement, as long as they do not transmit, save, or cache FLAG_SECURE protected content for access outside of the user's device.