Google Play Integrity API: Difference between revisions

Line 46:

==Consumer impact summary==

Since the Play Integrity API relies on Google to certify devices, any apps requiring <code>MEETS_DEVICE_INTEGRITY</code> or <code>MEETS_STRONG_INTEGRITY</code> are only allowed on operating systems that Google allows. This allows Google to exert [[Monopoly|monopolistic]] power by not certifying competitors' operating systems, since many apps choose to use the Play Integrity API instead of the Key Attestation API that is built into Android.<ref>{{Cite web |title=Apps & Games need PI |url=https://xdaforums.com/t/4677050/ |website=XDA Forums}}</ref><ref>{{Cite web |title=Verify hardware-backed key pairs with key attestation |url=https://developer.android.com/privacy-and-security/security-key-attestation |website=Android Developers |archive-url=http://web.archive.org/web/20260126145522/https://developer.android.com/privacy-and-security/security-key-attestation |archive-date=26 Jan 2026}}</ref>

Since the Play Integrity API relies on Google to certify devices, any apps requiring <code>MEETS_DEVICE_INTEGRITY</code> or <code>MEETS_STRONG_INTEGRITY</code> are only allowed on operating systems that Google allows. This allows Google to exert [[Monopoly|monopolistic]] power by not certifying competitors' operating systems, since many apps choose to use the Play Integrity API instead of the Key Attestation API that is built into Android.<ref>{{Cite web |title=Apps & Games need PI |url=https://xdaforums.com/t/4677050/ |url-status=live |archive-url=https://web.archive.org/web/20260321132210/https://xdaforums.com/t/apps-games-need-pi-list.4677050/ |archive-date=21 Mar 2026 |website=XDA Forums}}</ref><ref>{{Cite web |title=Verify hardware-backed key pairs with key attestation |url=https://developer.android.com/privacy-and-security/security-key-attestation |website=Android Developers |archive-url=http://web.archive.org/web/20260126145522/https://developer.android.com/privacy-and-security/security-key-attestation |archive-date=26 Jan 2026}}</ref>

Notable examples of apps requiring Google-certified operating systems:

Line 57:

*Twitter/X

*Twilio Authy Authenticator

*ChatGPT<ref>{{Cite web |title=PlayIntegrity Verification failed - ChatGPT / Bugs |url=https://community.openai.com/t/1267945 |website=OpenAI Developer Community}}</ref><ref>{{Cite web |title=Question - ChatGPT error: Preauth Playintegrity verification failed |url=https://xdaforums.com/t/4737618/ |website=XDA Forums}}</ref>

*ChatGPT<ref>{{Cite web |title=PlayIntegrity Verification failed - ChatGPT / Bugs |url=https://community.openai.com/t/1267945 |archive-url=https://web.archive.org/web/20260321132214/https://community.openai.com/t/playintegrity-verification-failed/1267945 |archive-date=21 Mar 2026 |website=OpenAI Developer Community}}</ref><ref>{{Cite web |title=Question - ChatGPT error: Preauth Playintegrity verification failed |url=https://xdaforums.com/t/4737618/ |url-status=live |archive-url=https://web.archive.org/web/20260321132235/https://xdaforums.com/t/chatgpt-error-preauth-playintegrity-verification-failed.4737618/ |archive-date=21 Mar 2026 |website=XDA Forums}}</ref>

This has led to users being unable to use apps on privacy-focused forks of Android, like [[wikipedia:GrapheneOS|GrapheneOS]].<ref>{{Cite web |title=Wallet - Google Pay |url=https://discuss.grapheneos.org/d/475/ |website=GrapheneOS Discussion Forum |archive-url=http://web.archive.org/web/20250708193935/https://discuss.grapheneos.org/d/475/ |archive-date=8 Jul 2025}}</ref>

@@ Line 46: / Line 46: @@
 ==Consumer impact summary==
-Since the Play Integrity API relies on Google to certify devices, any apps requiring <code>MEETS_DEVICE_INTEGRITY</code> or <code>MEETS_STRONG_INTEGRITY</code> are only allowed on operating systems that Google allows. This allows Google to exert [[Monopoly|monopolistic]] power by not certifying competitors' operating systems, since many apps choose to use the Play Integrity API instead of the Key Attestation API that is built into Android.<ref>{{Cite web |title=Apps & Games need PI |url=https://xdaforums.com/t/4677050/ |website=XDA Forums}}</ref><ref>{{Cite web |title=Verify hardware-backed key pairs with key attestation |url=https://developer.android.com/privacy-and-security/security-key-attestation |website=Android Developers |archive-url=http://web.archive.org/web/20260126145522/https://developer.android.com/privacy-and-security/security-key-attestation |archive-date=26 Jan 2026}}</ref>
+Since the Play Integrity API relies on Google to certify devices, any apps requiring <code>MEETS_DEVICE_INTEGRITY</code> or <code>MEETS_STRONG_INTEGRITY</code> are only allowed on operating systems that Google allows. This allows Google to exert [[Monopoly|monopolistic]] power by not certifying competitors' operating systems, since many apps choose to use the Play Integrity API instead of the Key Attestation API that is built into Android.<ref>{{Cite web |title=Apps & Games need PI |url=https://xdaforums.com/t/4677050/ |url-status=live |archive-url=https://web.archive.org/web/20260321132210/https://xdaforums.com/t/apps-games-need-pi-list.4677050/ |archive-date=21 Mar 2026 |website=XDA Forums}}</ref><ref>{{Cite web |title=Verify hardware-backed key pairs with key attestation |url=https://developer.android.com/privacy-and-security/security-key-attestation |website=Android Developers |archive-url=http://web.archive.org/web/20260126145522/https://developer.android.com/privacy-and-security/security-key-attestation |archive-date=26 Jan 2026}}</ref>
 Notable examples of apps requiring Google-certified operating systems:
@@ Line 57: / Line 57: @@
 *Twitter/X
 *Twilio Authy Authenticator
-*ChatGPT<ref>{{Cite web |title=PlayIntegrity Verification failed - ChatGPT / Bugs |url=https://community.openai.com/t/1267945 |website=OpenAI Developer Community}}</ref><ref>{{Cite web |title=Question - ChatGPT error: Preauth Playintegrity verification failed |url=https://xdaforums.com/t/4737618/ |website=XDA Forums}}</ref>
+*ChatGPT<ref>{{Cite web |title=PlayIntegrity Verification failed - ChatGPT / Bugs |url=https://community.openai.com/t/1267945 |archive-url=https://web.archive.org/web/20260321132214/https://community.openai.com/t/playintegrity-verification-failed/1267945 |archive-date=21 Mar 2026 |website=OpenAI Developer Community}}</ref><ref>{{Cite web |title=Question - ChatGPT error: Preauth Playintegrity verification failed |url=https://xdaforums.com/t/4737618/ |url-status=live |archive-url=https://web.archive.org/web/20260321132235/https://xdaforums.com/t/chatgpt-error-preauth-playintegrity-verification-failed.4737618/ |archive-date=21 Mar 2026 |website=XDA Forums}}</ref>
 This has led to users being unable to use apps on privacy-focused forks of Android, like [[wikipedia:GrapheneOS|GrapheneOS]].<ref>{{Cite web |title=Wallet - Google Pay |url=https://discuss.grapheneos.org/d/475/ |website=GrapheneOS Discussion Forum |archive-url=http://web.archive.org/web/20250708193935/https://discuss.grapheneos.org/d/475/ |archive-date=8 Jul 2025}}</ref>