Google Will Force Phone OEMs To Provide 2 Years Of Android Security Updates

Android users know that not all devices receive the security updates that Google puts out in a timely manner. Slow updates are especially common when the devices start to age or when devices aren’t that popular, and the manufacturer moves on to the next greatest thing. Google contracts have leaked that show it is now forcing Android device makers to guarantee security updates are offered for the smartphone no matter if it's a cheap low-end device, a mid-range smartphone like the recently unveiled Samsung Galaxy A9, or a high-end device like the Galaxy Note 9.

Under the Google contract, all device makers are required to regularly install updates for any phone or tablet for at least two years post-launch if the device reaches a specific threshold for units activated. That specific threshold is 100,000 units activated for any device that launches after January 31, 2018. If the device reaches that threshold, the manufacturer is required to provide "at least four security updates" within one year of device launch.

When the device enters its second year of life, security updates are mandated, but Google doesn’t specify how many updates the manufacturer is required to provide in that second year. Google's contract does stipulate that the manufacturers must patch flaws identified by Google within a specific timeframe; the timeframe Google is enforcing requires by the end of each month that all vulnerabilities identified more than 90 days before the end of the month are patched. This clause essentially means that all Android devices are required to have regular patches applied and would mean at least quarterly patches for all devices in their second year. These same rules for security updates were applied to 75% of "security mandatory models" starting July 31.

Punishment for failing to follow the rules in the new Android contract means that Google can withhold approval of future devices from the manufacturer, preventing the device from being launched. These new Android terms have surfaced in the Google licensing agreement specifically for devices sold in the EU that are bundled with Google apps. It's assumed that the same terms are in the global licensing contract for Android devices, but that is unconfirmed at this time. There is no method for buyers of Android phones or tablets to know if their device is covered under the update requirements, but most popular devices would certainly see more than the minimum 100,000 activations if sold globally.