Google Play July Policy Update: Minor Protection, Package Name Registration, and Compliance Guide

Google Play Continues to Tighten Platform Governance

The Google Play Developer Experience team has announced a series of policy updates and clarifications in the latest edition of Policy Bytes. The core goal behind these changes is straightforward — to make Google Play a safer and more trustworthy platform. For developers, this means not only upgraded compliance requirements, but also several deadline-driven action items that warrant early attention.

This update can be organized around three main themes: age restriction policies related to minor protection, app package name registration requirements (in conjunction with Android Developer Verification), and multiple policy clarifications covering user data, content ratings, and financial security. Let's break down each of these changes and their practical implications for developers.

Minor Protection: Mandatory Age Gating for Stranger and Anonymous Chat Apps

The most closely watched update this round is the age restriction policy targeting random chat and anonymous chat applications.

Google Play now requires all such apps to implement effective age-gating mechanisms that fully prevent minors from accessing the service. The prescribed approach is to select the appropriate age group in the target audience settings, thereby excluding underage users at the source.

What Is Age-Gating? Age-gating refers to the technical and procedural mechanisms that digital platforms use to restrict access to content or services for users below a certain age. Implementations range from simple "self-declaration" (users entering their own date of birth) to stricter "document verification" (uploading an ID). As privacy protection becomes increasingly important, striking a balance between effective age verification and minimal data collection is a shared challenge for regulators and developers alike. Regulations such as the EU's Digital Services Act (DSA) and the UK's Online Safety Act (OSA) mandate age verification requirements for the protection of minors. Google's latest policy tightening is a platform-level response to this global regulatory trend.

The policy clearly defines the types of apps affected:

• Random connection apps: Apps whose core functionality is to randomly pair users, allowing strangers to have spontaneous conversations;
• Anonymous communication apps: Apps where the identity of one or more users is deliberately concealed.

In parallel, Google has also updated its Families Policy requirements and Child Safety Standards. For developers running social, dating, or anonymous sharing products, this means a mandatory review of existing age verification processes — failure to comply risks app removal.

Play Console Package Name Registration: 99% of Apps Completed Automatically

To support Android Developer Verification — a new security layer — Google Play has updated the relevant requirements in Play Console. This mechanism is designed to protect users from scams, financial fraud, and malicious apps.

The Technical Logic Behind Android Developer Verification The core of Android Developer Verification is a strong linkage between developer accounts and real-world identity information (such as business registration details or individual developer credentials), establishing a traceable trust anchor throughout the app distribution chain. The package name, as the unique identifier for an Android app, once bound to a verified developer account, effectively prevents bad actors from publishing malicious versions that impersonate well-known apps — a tactic that has appeared frequently in incidents involving counterfeit financial and government apps. This mechanism works in tandem with Google Play Protect to form a layered defense system and constitutes a key part of the platform's anti-fraud infrastructure.

In rolling this out, Google has minimized the migration burden for developers — the platform leveraged developers' existing verification information to automatically complete package name registration for over 99% of eligible apps. This means the change practically only affects a very small number of apps that were not automatically registered.

If your app is still unregistered, you'll need to manually complete the package name registration in Play Console. Check your app's status on the Play Console homepage and take care of it promptly to ensure your app's distribution is not affected.

Three Policy Clarifications: AI Integration, Content Ratings, and Financial Services

Beyond new policies, Google has also clarified several existing rules — details that developers can easily overlook.

User Data Policies Apply to Third-Party AI Integrations

As AI capabilities are widely integrated into all kinds of apps, Google has made it clear: user data requirements apply equally to third-party AI integrations. Developers are responsible for compliance across three dimensions: limited use, disclosure, and user consent. Integrating an external AI service is not a valid reason to sidestep data compliance obligations.

Why Does AI Integration Create New Data Compliance Challenges? Integrating third-party AI services (such as the OpenAI API, Google Gemini API, and other large model interfaces) into mobile apps has become a mainstream development paradigm since 2023. However, text, image, or voice data entered by users may be used by AI service providers for model training or log retention without the developer's full awareness. By explicitly requiring "limited use, disclosure, and user consent," Google is effectively extending the API data use norms established in the OAuth 2.0 era into the AI context. When integrating third-party AI, developers must review the provider's Data Processing Agreement (DPA) and clearly disclose data flows in their privacy policies — they cannot simply rely on "the third party is responsible for their own terms of service" to avoid accountability.

"Unrated App" Concept Removed; Content Rating Now a Hard Requirement

Google has removed the term "unrated app" from its policies, further clarifying that only apps that have completed content rating are permitted to be listed on Google Play. This is a stronger statement of the content rating requirement, and developers who have not yet completed the rating process should do so as soon as possible.

Industry Background on Content Rating Systems App content rating systems are derived from the rating schemes of the traditional film and video game industries, such as the ESRB in the US and PEGI in Europe. In the mobile app space, Google Play uses the IARC (International Age Rating Coalition) standard, generating localized rating labels for different countries and regions through a self-assessment questionnaire. Content ratings are not only a compliance requirement — they directly affect an app's visibility in specific regions. In markets with strict controls on content for minors, such as Germany and Brazil, apps that are not correctly rated may be filtered out of search results entirely. Google's removal of the "unrated app" concept marks a formal upgrade from "encouraged to complete" to "a prerequisite for listing," bringing it in line with Apple App Store's long-standing mandatory rating policy.

Financial Services: Clarifying the Line Between Payday Loans and Earned Wage Access

In the financial services terms, Google has added general and country/region-specific requirements for loans and earned wage access (EWA), helping developers clearly distinguish between the compliance standards applicable to payday loans and earned wage access services — two categories of products under heightened regulatory scrutiny.

The Fundamental Difference Between the Two Payday loans are short-term, high-interest loans with repayment due on the borrower's next payday. Annual Percentage Rates (APR) can reach 300%–400% in some markets, and they have long been subject to strict oversight from consumer financial protection agencies (such as the CFPB in the US) due to their debt-trap effects. Earned Wage Access (EWA) allows employees to access wages they have already earned but not yet been paid, making it fundamentally an employer benefit tool rather than a credit product — it typically charges no interest, only a small service fee. The two differ fundamentally in their business models and regulatory frameworks, but some EWA products have been reclassified as loan products by regulators due to opaque fee structures. Google's clarification is intended to help developers correctly categorize their products based on their actual nature, avoiding policy violations stemming from misclassification.

SMS and Call Log Permissions Further Restricted

Google has removed the exception that previously allowed account verification via phone calls from the documentation for the SMS and Call Log permission groups. The recommended alternatives are the Digital Credentials API and the SMS Retriever API.

The Technical Principles Behind the Alternatives The SMS Retriever API is a solution developed by Google that enables automatic SMS verification code autofill without requiring the SMS read permission. It works by embedding an app-specific hash value in the SMS content; the Android system then only passes back to the corresponding app the content of matching messages, enabling automatic verification while protecting the user's SMS privacy. The Digital Credentials API is a newer generation identity credential interaction standard that supports interaction with digital identity documents stored in a device wallet (such as mDL, the mobile driver's license). It is the Android implementation of W3C's digital credentials standards. Driving developer migration to these APIs is a concrete expression of Google's "Permission Minimization" strategy and aligns with the trend of continuously strengthened runtime permission controls since Android 13.

This adjustment continues Google's long-standing trend of tightening sensitive permissions. Affected developers should complete the interface migration as soon as possible.

Key Deadline: August 31 Target API Level Enforcement

The single most important hard deadline for developers to keep in mind is the cutoff for the annual Target API Level update.

The Technical and Security Significance of Target API Level Requirements The Target API Level (i.e., targetSdkVersion) is a key manifest parameter through which an Android app declares its expected runtime environment. This value directly affects how the system constrains app behavior: the higher the targetSdkVersion, the stricter the security sandbox rules the app must comply with — for example, background location permission restrictions, Scoped Storage, and precise alarm permissions are all tied to this value. Google's annual requirement for apps to upgrade their targetSdkVersion to no lower than the previous year's major Android release is essentially a market mechanism to force the elimination of malicious apps and zombie apps that exploit the more permissive behavior of older system versions. The 2024 deadline corresponds to Android 14 (API Level 34); apps that do not meet the requirement will be unable to distribute to new users running the latest version of Android.

Google requires developers to ensure their apps meet the latest Target API Level requirements by August 31. This is a mandatory update, critical to ensuring the safety and user experience of Android and Google Play users. Apps that are not updated by the deadline may be unable to distribute to new users or may face functional restrictions — be sure to schedule this work well in advance.

Developer Resources and Learning Channels

For this update, Google has provided several official learning and support channels:

• Google Play Academy: Offers free courses ranging from "Deceptive Behavior Policy" to "In-app Product Price Experiments," suitable for systematic catch-up learning;
• Policy webinars: Include Q&A sessions where you can ask Google's team questions directly. You must enable Google Play update notifications in Play Console to receive invitations;
• Google Play Community: A developer forum actively maintained by the official team, ideal for troubleshooting specific issues and seeking operational guidance.

Summary: Three Main Themes, One Key Deadline

Taken together, this batch of updates continues Google Play's consistent platform governance logic: steadily raising the bar on minor protection, identity verification, and data compliance. For most developers, the automation of package name registration has significantly reduced migration costs. Those who need to take immediate action are teams running social or anonymous apps, and developers who have not yet completed their Target API Level upgrade.

It is recommended to cross-reference the official complete policy checklist, assess the degree to which your products are affected, and complete all necessary adjustments before the August 31 deadline to avoid any disruption to your app's normal distribution due to compliance issues.

Key Takeaways