Google Play Protect checks apps before you download them from the Play Store, scans the device for harmful apps from other sources, warns you, and can disable or remove risky apps. It is on by default. It is a useful baseline, not a complete defence, so a policy should still cover updates and sign in security.
What Google says it does
Google's help page describes several behaviours.
- It checks apps before download from the Play Store.
- It scans the device for harmful apps from other sources.
- It warns about risky apps, and can disable or remove them.
- It sends privacy alerts.
- It can block unverified apps that request sensitive permissions often abused in financial fraud.
It scans at install time and periodically afterwards. For apps from outside the Play Store, the system may prompt you to scan, which sends app details to Google for a code level evaluation.
A privacy note
The same page says Google may receive information about device network connections, potentially harmful URLs and installed apps in order to protect against threats. Mention this in your employee notice if you require the feature, so nobody is surprised.
How to check it is on
- Open the Play Store app.
- Tap the profile icon at the top right.
- Tap Play Protect, then Settings.
- Confirm that Scan apps with Play Protect is on.
It is on by default and Google recommends keeping it on. For a team, ask people to confirm this once during onboarding.
What it does not do
- It does not manage the phone. It cannot enforce a screen lock or a minimum Android version.
- It does not detect a stolen password or a phishing page typed into a browser.
- It does not remove the need to read permission requests. A legitimate looking app can still ask for too much.
- It is not guaranteed to catch every harmful app, and no scanner is. New malware is by definition unknown for a while.
Pair it with these controls
- Install only from trusted sources. Sideloading expands your risk; see the sideloading checklist if you must.
- Keep updates current. Security patches close the holes that malware uses once installed.
- Use a work profile so company data sits apart from apps you do not control. The Android management modes guide compares the options.
- Use phishing resistant sign in for work accounts.
For developers distributing an app
If you ship an Android app, Play Protect will evaluate it like any other. Ship through Google Play where possible, keep dependencies patched, and sign releases consistently. A free dependency check at the Safeguard scan page at https://gold.safeguard.sh/scan is a quick way to see what is inside a project before release.
Quick check
Is Play Protect enough on its own?
No. It covers app scanning. It does not enforce updates, screen locks or protect against phishing.
Does it work for apps outside the Play Store?
It scans the device for harmful apps from other sources, and may prompt you to scan an outside app, which sends details to Google.
Sources
Last reviewed: 19 October 2026.
