Privacy security best practices  |  Android Open Source Project
Skip to main content
Docs
What's new?
Release notes
Latest security bulletins
Latest Compatibility Definition Document (CDD)
Site updates
Getting Started
About
Start
Download
Builds
Test
Create
Contribute
Community
Tools, build, and related reference
Security
Overview
Bulletins
Features
Testing
Best Practices
Core Topics
Architecture
Audio
Camera
Connectivity
Data
Display
Fonts
Graphics
Interaction
Media
Performance
Permissions
Power
Runtime
Settings
Storage
Tests
Updates
Virtualization
Compatibility
Compatibility Definition Document (CDD)
Compatibility Test Suite (CTS)
Android Devices
Cuttlefish
Enterprise
TV
Automotive
Overview
Software Defined Vehicle
In-vehicle Infotainment
Release Details
Reference
HIDL
HAL
Trade Federation
Security Test Suite
Android Code Search
/
English
Deutsch
Español – América Latina
Français
Indonesia
Italiano
Polski
Português – Brasil
Tiếng Việt
Türkçe
Русский
עברית
العربيّة
فارسی
हिंदी
বাংলা
ภาษาไทย
中文 – 简体
中文 – 繁體
日本語
한국어
Sign in
Documentation
What's New?
Getting Started
Security
Core Topics
Compatibility
Android Devices
Automotive
Reference
Docs
More
What's New?
Getting Started
Security
Core Topics
Compatibility
Android Devices
Automotive
Reference
Android Code Search
Overview
Security overview
Secure an Android device
Kernel security
App security
Implement security
Updates and resources
ASPIRE
Security reports
Enhancements
Acknowledgements
Android Security Bulletins
Bulletins home
Overview
2026 bulletins
July
June
May
April
March
February
January
Android 17
2025 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android 16
Android 16 QPR2
2024 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android 15
2023 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android 14
Index
2022 bulletins
December
November
October
September
August
July
June
May
April
March
Android 12L
February
January
Android 13
Index
2021 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android 12
Index
2020 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android 11
Index
2019 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android 10
Index
2018 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2017 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2016 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2015 bulletins
December
November
October
September
August
Index
Pixel/Nexus bulletins
Overview
2026 bulletins
July
June
May
April
March
February
January
2025 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2024 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2023 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2022 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2021 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2020 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2019 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2018 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Index
2017 bulletins
December
November
October
Index
Android Automotive
Overview
2026 bulletins
July
June
May
April
March
February
January
2025 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2024 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2023 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2022 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2021 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
Android XR
Overview
2026 bulletins
July
June
May
April
March
February
January
Chromecast
Overview
2025 bulletins
December
2024 bulletins
December
September
July
March
2023 bulletins
December
September
June
April
2022 bulletins
December
October
July
Wear
Overview
2026 bulletins
July
June
May
April
March
February
January
2025 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2024 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2023 bulletins
December
November
October
September
August
Pixel Watch
Overview
2026 bulletins
June
March
2025 bulletins
December
November
October
September
August
July
June
May
April
March
February
January
2024 bulletins
December
August
July
June
May
April
March
February
January
2023 bulletins
December
September
June
Advisories
Overview
March 2016
Features
Overview
Application Sandbox
OMAPI vendor stable interface
App signing
Overview
APK signature scheme v2
APK signature scheme v3
APK signature scheme v3.1
APK signature scheme v4
Authentication
Overview
Gatekeeper
Rate-limiting
Weaver
Biometrics
Overview
Measure biometric security
Fingerprint HIDL
Face authentication HIDL
Android Protected Confirmation
Overview
Implementation
UI design
Accessibility
DICE
Overview
Applications
Encryption
Overview
File-based encryption
Full-disk encryption
Metadata encryption
Enable Adiantum
Hardware-wrapped keys
Keystore
Overview
Features
Key and ID attestation
Version binding
Authorization tags
KeyMint functions
Identity Credential APIs
Overview
SELinux
Overview
Concepts
Implementation
Customization
Build sepolicy
Policy compatibility
Validation
Write policy
Vendor init
Trusty TEE
Overview
Download and build
Trusty API reference
Verified Boot
Overview
Device state
Use Verified Boot
Boot flow
Implement dm-verity
Verify system_other partition
Reference implementation
On-device signing
Safety Center
Overview
Cellular security
Overview
Disable 2G
2G connectivity toggle
Mobile network security
Private space
GPU syscall filtering
Testing
Overview
Memory safety
Arm Memory Tagging Extension
Overview
MTE bootloader support
Understand MTE reports
MTE configuration
Sanitizers
Overview
AddressSanitizer
Kernel AddressSanitizer
Hardware-assisted AddressSanitizer
Understand HWASan reports
UndefinedBehaviorSanitizer
Other topics
Control flow integrity
Control flow integrity in the kernel
Execute-only memory
Fuzz with libFuzzer
GWP-ASan and KFENCE
Android Security AutoRepro
Scudo
ShadowCallStack
Tagged pointers
Zero initialized memory
Best practices
Overview
Organizational and operational security
System security
App security
Network security
Hardware security
Privacy security
What's new?
Release notes
Latest security bulletins
Latest Compatibility Definition Document (CDD)
Site updates
Getting Started
About
Start
Download
Builds
Test
Create
Contribute
Community
Tools, build, and related reference
Security
Overview
Bulletins
Features
Testing
Best Practices
Core Topics
Architecture
Audio
Camera
Connectivity
Data
Display
Fonts
Graphics
Interaction
Media
Performance
Permissions
Power
Runtime
Settings
Storage
Tests
Updates
Virtualization
Compatibility
Compatibility Definition Document (CDD)
Compatibility Test Suite (CTS)
Android Devices
Cuttlefish
Enterprise
TV
Automotive
Overview
Software Defined Vehicle
In-vehicle Infotainment
Release Details
Reference
HIDL
HAL
Trade Federation
Security Test Suite
Effective in 2026, to align with our trunk stable development model and ensure platform stability for the ecosystem, we will publish source code to AOSP in Q2 and Q4. For building and contributing to AOSP, use android-latest-release. The android-latest-release manifest branch will always reference the most recent release pushed to AOSP. For more information, see Changes to AOSP.
AOSP
Docs
Security
Privacy security best practices
Stay organized with collections
Save and categorize content based on your preferences.
This page contains a collection of data collection guidance
and recommendations to ensure that Android users have control over the
handling of their data.
Data logging
Logging data increases the risk of exposure of that data and reduces system
performance. Multiple public security incidents have occurred as a result of
logging sensitive user data.
Don't log to the sdcard.
Apps or system services shouldn't log data provided from third-party
apps that might include sensitive information.
Apps must not log any Personally Identifiable Information (PII) as
part of normal operation, unless it's absolutely necessary to provide the
core functionality of the app.
CTS includes tests that check for the presence of potentially sensitive
information in logs.
Metrics collection
Collecting metrics can be an essential part of understanding usage of your
app and making improvements for the overall user experience. However, overly
broad metrics collection can also present a risk to user privacy.
If at all possible, don't collect metrics.
If you must collect metrics, first request explicit, informed,
and meaningful user consent.
With few exceptions, only collect metrics that are necessary to support
the reliability of the service.
Avoid collecting identifiable or potentially sensitive data whenever
possible, such as
hardware identifiers.
Ensure data is sufficiently aggregated and anonymized whenever possible.
Spyware
Spyware is defined as software that aims to gather information about a user
or device without their knowledge, that might send user information to another
entity without consent.
Transmission of the following user or device data without disclosure or
in a manner that is unexpected to the user is considered spyware (this
list contains top examples, but isn't an exhaustive list):
Information about the user's contacts (names, numbers, emails)
Photos or other files
Content from user email
Call log
SMS log
Web history
Browser bookmarks
Private information from other apps (private /data/
directories)
Audio or call recording
Passwords
OAuth tokens
Location
Ensure that all apps provide a reasonable explanation disclosure to
the user prior to installation.
Content and code samples on this page are subject to the licenses described in the Content License. Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
Last updated 2024-09-24 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-09-24 UTC."],[],[]]
Build
Android repository
Requirements
Downloading
Preview binaries
Factory images
Driver binaries
Connect
@Android on X
@AndroidDev on X
Android Blog
Google Security Blog
Platform on Google Groups
Building on Google Groups
Porting on Google Groups
Get help
Android Help Center
Pixel Help Center
www.android.com
Google Mobile Services
Stack Overflow
Issue Tracker
About Android
Community
Legal
License
Privacy
Site feedback
Manage cookies
English
Deutsch
Español – América Latina
Français
Indonesia
Italiano
Polski
Português – Brasil
Tiếng Việt
Türkçe
Русский
עברית
العربيّة
فارسی
हिंदी
বাংলা
ภาษาไทย
中文 – 简体
中文 – 繁體
日本語
한국어