Google Play Protect Review: Please Get Something Else

As the native Android antivirus option, Google Play Protect should have a real edge over rival apps, given that it's already installed on your device. The main problem is that it gets consistently awful malware-detection results in third-party lab tests, and an antivirus solution that can't detect malware reliably isn't much good to anyone.

Take a look at Bitdefender Mobile Security if you are willing to pay for your Android antivirus solution, and the free version of Norton Mobile Security if you want strong malware protection without the additional cost. Both are on our list of best Android antivirus apps, while Google Play Protect isn't.

Google Play Protect costs and what's covered

If your Android device has Google Play, it has Google Play Protect. You can choose to turn the service off if you wish, but as of 2018, it is turned on by default on all new Google-provisioned Android devices. To be clear, Google Play Protect is not a full antivirus solution like the other seven apps that I tested in early 2019, but it does try to protect your device from malware.

Technically, that is the extent of the functionality of Play Protect, but we'll cover Find My Device as well, since similar features are found in many of the antivirus apps that I tested, and this free native option is found in the same settings menu as Play Protect.

Malware protection

Google Play Protect regularly scans the apps that are installed or updated on your device. You can choose to trigger a scan yourself by going to Settings > Security & Location > Google Play Protect, but there is no option to schedule a scan. This is in keeping with the general idea that Google Play Protect is always running in the background and monitoring for threats.

There were a few updates in the last year to enhance the functionality of Google Play Protect. The app will now notify you if you are installing what it deems to be a "new or rare app" – basically, an app that hasn't been seen often by Google's cloud-based systems will trigger a warning to the user to be cautious with whatever is being installed.

An update in 2019 brought contextual pop-up warnings when a potentially dangerous app is actually being launched. This was introduced to deal with notification fatigue, as sometimes users will dismiss warnings when they aren't directly associated with a user action, which could lead to potentially catastrophic results with malware.

Finally, Google Play Protect also gained the ability to flag apps on a user's device that had been removed from the Play Store due to violations of Google Play policies. Particularly egregious apps are disabled entirely. This feature won't remove the app from your device, but will recommend that you remove the app yourself.

Malware detection

Google Play Protect had a typically rough outing in German independent lab AV-TEST's March 2019 evaluations of Android security products. It detected only 62% of the 3,083 "real-time" online malware threats it faced, and 69.2% of the 2,851 malware samples that had been collected in the previous four weeks.

That's no fluke. In January 2019, Google Play Protect detected 66.8% of real-time malware and 62.2% of recently collected samples. These were the lowest scores among the 19 Android antivirus apps tested in March, and the 18 antivirus apps tested in January, by AV-TEST. They were also well below the industry averages.

Of the other Android antivirus apps that I reviewed, five submitted to AV-TEST evaluations in January and March 2019.

Bitdefender Mobile Security and Norton Mobile Security each achieved a 100/100 percent detection rate in both months. Kaspersky Mobile Antivirus, also known as Kaspersky Internet Security for Android, was next with perfect scores in March and a statistically nearly identical 99.9/100 in January.

Avast Mobile Security did perfectly in January but blocked only 99.7% of real-time malware in March. McAfee Mobile Security scored between 99.1% and 99.9% in both categories in both months.

MORE: Best Android Antivirus Apps 2019

Google Play Protect has never fared well in these evaluations. Since AV-TEST began evaluating it in September 2017, the best result it had was in November 2018 with a 66.9/79.6. The rest of the results have fluctuated from the mid-40s to the low 70s, with an average just above 63%.

That means that between 30% and 40% of malware is getting through, as opposed to 0.1% or 0.2% with most other products (and no malware at all with Norton). You cannot rely on Google Play Protect to protect your Android device from infection.

Two of the apps that I reviewed in 2019, 360 Security and Lookout Security & Antivirus, no longer submit samples to AV-TEST for evaluation.

There aren't any other features that are expressly part of Play Protect, but Google does offer a couple of other security features built into the operating system.

Find My Device
Available on Android devices since 2013, Find My Device covers the basics that most users want from an anti-theft solution. You can access the features from the app on another device that is logged into your Google account, by going to Android.com/find, or by simply typing "find my phone" into Google.com if you are signed into your Google account.

You can have a lost device play a sound for 5 minutes straight, even if the device is set to silent mode. You can remotely lock the device and display a message on the lock screen and/or provide a phone number.

If you do provide a phone number, a large green circle appears in the middle of the screen with a phone icon and tapping it will automatically call the number you provided. Finally, you can choose to erase the device completely, but only if you've given up on finding the phone, as you will no longer be able to track it after the wipe.

I tested every feature other than the full erase, and they all worked within 1-2 seconds of activating them via the app or website. Not every third-party Android antivirus app can claim such success.

Chrome Safe Browsing
Again, this isn't a part of Play Protect, but it is a free tool built into the Chrome Browser preinstalled on Android devices. Safe Browsing should be enabled by default, but you can verify that it is active by tapping the menu button in the upper-right corner of the Chrome app and selecting Settings > Privacy. The box next to "Safe Browsing" should have a blue checkmark.

That's all there is to it. I used a known malicious test site to verify that Chrome Safe Browsing could catch a variety of different potential malware and phishing attacks. Again, not every antivirus app I tested could do that.

System impact

To evaluate the impact of running Google Play Protect on my device, I conducted multiple tests using the Geekbench 4 Android benchmarking tool on my Google Pixel 3 running Android 9.0 Pie. First, I ran a number of tests to establish a baseline performance for the device while Google Play Protect was deactivated. Then I ran additional tests following reactivation and during a full scan with the antivirus app.

Android's system settings allowed me to disable Google Play Protect to establish a baseline. After I reactivated Play Protect, the device saw a 2.34% decrease in performance. A full scan resulted in a slightly greater 2.66% slowdown.

This put Google Play Protect in fourth place among the eight apps that I tested for post-installation system impact on installation, and first place for full-scan performance.

Given that this is a native piece of the operating system, it was a bit surprising not to see Google Play Protect perform better in the post-installation test, but overall the app had a fairly minimal impact.

Setup and support

If your Android device has the Google Play Store, then you have Google Play Protect. It is active by default and will make itself known only if it detects a threat.

Support, as is usually the case with Android, is up to your manufacturer, but you can check the Android support page to see if there's an answer there.

Interface

Play Protect doesn't have much of an interface, but as a native part of the operating system, it fits well with the rest of the settings. I quite like the design of the Find My Device app and web portal. Even the alert that pops up on your device lock screen is the best implementation among the apps that I tested.

Bottom line

We now have nearly two years of data to support the notion that you should definitely not rely on Google Play Protect as your only method of protection against malicious apps.

I wouldn't recommend disabling it, either. It has limited impact on your system, and I have faith that it will eradicate any malicious content that it does find on your device. But you need to augment it with an antivirus solution from our selection of best Android antivirus apps that has a stronger track record of finding emergent threats, such as Bitdefender Mobile Security or Norton Mobile Security.

Comments are closed.