Google Play tightens its policies: New RAM usage limits, automatic migration, and more

Key points:
  • Google Play will penalize apps that exceed the maximum thresholds for active and background RAM starting in February 2027.
  • Strict limits are established, divided by categories of physical RAM on the device, with differentiated ranges for apps and games.
  • Starting in April 2027, the Zero-Tap Sign-In standard will come into effect, requiring the use of the Restore Credentials API for account migration.
  • Android 17 strengthens network connections with TLS ECH encryption, native Certificate Transparency, and permissions for local networks.
  • Operators will be able to disable the default 2G connection to prevent SMS scams through forced network degradation.
David Y. NaranjoUpdated on

5 minutes

Android-RAM

Google recently announced a new set of requirements and quality standards for Android and its Google Play Store. This initiative directly addresses hardware supply chain constraints and the growing shortage of RAM modules in the global smartphone market.

To prevent apps from excessively consuming resources and causing slowdowns or forced shutdowns of the operating system, the company will begin auditing and penalizing excessive memory usage starting in February 2027. Developers whose apps exceed the stipulated limits could face restrictions on publishing new versions and a severe loss of visibility in Play Store searches and recommendations.

Performance metrics and limits per RAM level

Monitoring will be based on three pillars within the Android Vitals platform on the Play Console.

  • The first is dynamic memory consumption, which tracks anonymous RSS usage in addition to data derived to the swap partition or file, evaluating both the active state from the foreground application such as its background behavior.
  • El The second parameter audits the use of bitmaps (bitmaps) of picturesGoogle requires that uploaded images not unnecessarily retain memory when the application enters a hidden or cached state.
  • El The third point requires the optimization of the executable code in DEX format. (Dalvik Executable): Packages must be processed with reduction and obfuscation tools such as R8, requiring a minimum of 25% combined coverage between optimization, removal of unused code, and shortening of identifiers to lighten the load on volatile memory.

The maximum allowed thresholds will be calculated in stages based on the device's physical RAM capacity. For standard applications, the limits are configured as follows:

  • Devices with 4 GB of RAM: Maximum of 2 GB in active state and 1 GB in background.
  • Devices with 8 GB of RAM: Maximum of 2.25 GB in the foreground and 1.5 GB in the background.
  • Devices with 12 GB of RAM: Maximum of 3.25 GB in the foreground and 1.75 GB in the background.
  • Devices with 16 GB of RAM: Maximum of 4.25 GB in the foreground and 2 GB in the background.

For mobile video games, since these are environments with higher graphical and processing demands, wider margins have been set:

  • 4GB RAM devices: Limit of 2.25GB in active use and 2GB in background.
  • 8GB RAM devices: Limit of 3.5GB in active use and 2.75GB in background.
  • 12GB RAM devices: Limit of 4GB in active use and 3.2GB in background.
  • 16GB RAM devices: Limit of 5GB in active use and 3.5GB in background.

In addition to resource control, Google Play will implement a new onboarding requirement starting in April 2027. Known as the Zero-Tap Sign-In standard , this policy will require all apps that support user sign-in (mandatory or optional) to fully automatically restore the session when the user migrates their data to a new Android device.

To comply with this regulation, developers must integrate the Android Restore Credentials API, ensuring that users can instantly access their accounts upon opening the app for the first time without having to manually re-enter their passwords. Currently, video games are exempt from this specific requirement due to the complexity of their authentication schemes, although Google recommends adopting the API for titles with unique profiles.

Security improvements in Android 17

Alongside these store regulations, the Android 17 development branch incorporates mechanisms for protecting network communications. First, it enables compatibility with the TLS ECH (Encrypted ClientHello) extension, the successor to ESNI.

Unlike previous technologies that exposed metadata during the initial connection, ECH fully encrypts the initial ClientHello message, hiding the domain name of visited websites in HTTPS traffic and preventing leaks through fields such as the pre-shared key (PSK).

Secondly, the Local Area Network Protection system is being launched , which requires applications to request explicit permission from the user before they can scan the home network or interact with devices connected to the local area network (LAN).

Additionally, the Certificate Transparency (CT ) mechanism is enabled by default, maintaining a public and immutable record of all issued and revoked digital certificates to detect anomalies or compromises in Certification Authorities (CAs).

Finally, Android 17 gives mobile operators the ability to disable 2G networks by default, neutralizing attacks based on fake base stations that forced signal degradation to intercept SMS traffic and deploy fraud campaigns.

If you are interested in learning more, you can find the details at the following link.


Add as preferred source in Google