Google says Advanced Protection program users will no longer be able to sideload apps or turn off Google Play Protect, which scans apps for malicious behavior
Context & Ripple Effects
Advanced Protection began in 2017 as an opt-in fortress for high-profile targets, swapping SMS codes for physical security keys and cutting off third-party apps entirely (launched as a program marketed at high-profile users). Since then Google has been building the enforcement layer underneath: Play Protect's malware scanning rolled out across GMS devices in 2017, and by late 2023 it had added real-time code-level scanning that prompts users before unknown apps install.
The change matters because the safety net is now compulsory. A [[a:845931|TechCrunch hands-on found Play Protect's real-time scanning let five predatory loan apps and two fake apps through]], so Google is removing the manual escape hatch from a cohort of journalists, activists, and executives even though its automated filter has documented misses.
First-order effects
- Users enrolled in Advanced Protection lose both levers at once: no more sideloading outside Google Play and no way to switch off Play Protect, locking them into whatever its scanner catches or misses.
Second-order effects
- Power users and organizations weighing enrollment now face a stricter trade-off — the program's physical-key security comes bundled with Google's app-distribution rules, which may push sideload-dependent buyers toward standard accounts instead.
Third-order effects
- If the pattern holds, protections piloted on an opt-in cohort become defaults that migrate outward, tightening Google's role as gatekeeper over what can run on Android and shrinking the space where users can override platform security decisions.
The trend: Android security is shifting from user-toggled safeguards to enforced platform defaults, with Google converting its most restrictive account tier into a template for mandatory scanning.