All Episodes

November 3, 2025 10 mins
Upwardly Mobile: Episode Notes Episode Title: App Store Revolution: Google Play Opens to Third-Party Payments (The Epic Games Aftermath) Summary: In this episode of Upwardly Mobile, we break down the monumental shift in the Android ecosystem following the Supreme Court’s refusal to hear Google's final appeal. Google has finally opened its Google Play app store to third-party payment options for U.S. developers, settling a multi-year legal battle initiated by Epic Games. We discuss what this means for developers seeking to maximize revenue, the new freedom to direct users to cheaper external payment options, and the resulting challenges in maintaining app integrity and security now that developers are operating outside Google Play Billing exclusivity. Plus, we explore crucial security solutions, like Approov, that can help developers protect their apps when relying less on Google Mobile Services (GMS) for integrity checks. Key Takeaways
  • Policy Shift: Following years of legal challenges, Google is now required to allow U.S. app developers to use alternative payment methods and link users directly to external payment sources. This means developers can process payments outside of Google’s ecosystem and inform users about alternative pricing.
  • End of Exclusivity: Previously, Google generally mandated the use of Google Play Billing and collected a commission on nearly every in-app purchase. Now, developers can provide direct links to external checkout pages and offer options like PayPal or their own payment systems.
  • Timeline and Scope: This change became effective immediately as of October 29, 2025. However, the new rules currently apply only in the U.S. and the District Court order is set to expire on November 1, 2027.
  • Security Challenges: While developers gain freedom and potential revenue maximization by avoiding Play Store commissions, distributing and processing payments externally requires implementing their own robust security, update, and analytics systems, as Play services like integrity verification may not be available.
  • App Attestation Alternative: For developers building non-GMS Android apps or those seeking customizable security outside of Google’s structure, Approov provides a solution. Approov is a runtime application self-protection (RASP) tool that offers app attestation—verifying the integrity and authenticity of an app and the device it runs on—without relying on Google PlayIntegrity or SafetyNet.
Sponsored by Approov Protect your app and APIs regardless of your payment processing choices. Approov offers comprehensive runtime application self-protection (RASP) and serves as a reliable, GMS-independent alternative to Google PlayIntegrity for robust app attestation and real-time threat detection. Learn more or start a free trial today: approov.io Relevant Links & ResourcesKeywords Google Play, third-party payments, Epic Games, app store, commission, app security, app attestation, Approov, U.S. court ruling, Google Play Billing, non-GMS apps, developer revenue, digital payments, emerging payments, API security.            
Mark as Played
Transcript

Episode Transcript

Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
Welcome to upwardly Mobile API and app Security. I'm your host,
joined by our expert contributor.

Speaker 2 (00:06):
Great to be here.

Speaker 1 (00:07):
Today. We're looking at something massive, a real shakeup in
mobile monetization. The Supreme Court's decision forcing Google to open
the play Store to third party payments in the US.

Speaker 2 (00:18):
Yeah, this is a big one. It's got huge implications
not just for how you make money, but for compliance
and crucially for security for everyone. Really, iOS, Android, Flutter, React,
Native developers.

Speaker 1 (00:32):
Absolutely, And our goal today is to well break down
what this actually means technically, how developers can navigate this
new landscape and.

Speaker 2 (00:40):
Compared to what Apple phaced earlier, because the rules aren't
quite the same and that difference matters.

Speaker 1 (00:45):
Okay, let's unpack this. So the core issue was the
Epic Games lawsuit, right. They argued Google had an illegal monopoly.

Speaker 2 (00:51):
With play billing exactly, and Google fight it all the
way to the Supreme Court, which basically said nope, appeal rejected.
So now Google has to follow that original District Court injunction.

Speaker 1 (01:00):
And that injunction changes things immediately. What are the key
dates developers need to know?

Speaker 2 (01:05):
Well, technically it's effective now, but the real implementation deadlines
seem to be clustering around late October twenty twenty five.
October twenty ninth is the date mentioned. Okay, and these
specific terms, they're said to expire November first, twenty twenty seven.
For now, it's just US customers.

Speaker 1 (01:23):
Remember, right, US only for now? But what can developers
actually do differently?

Speaker 2 (01:28):
This is the fascinating part. Developers can now tell users
straight up, hey, you can pay less on our website.
They can put direct links in the app to their
own checkout pages.

Speaker 1 (01:38):
WHOA, okay, so no more vagants. You can just link
out directly.

Speaker 2 (01:42):
Yep, link out. Offer different payment methods, credit card, PayPal,
whatever system you use, completely outside of Google Play billing.
Google can't enforce that billing exclusivity in the US anymore.

Speaker 1 (01:52):
Or penalize you for promoting external payments.

Speaker 2 (01:55):
Correct, that restriction has gone in the US market.

Speaker 1 (01:57):
That sounds incredibly good for developers, almost too good. If
Google can't take a cut from these external sales, why
wouldn't everyone just switch immediately? Isn't there some catch?

Speaker 2 (02:07):
Well? Yes and no. The ruling does bar Google from
charging commissions on those external purchases, which is, like you said,
revolutionary okay, But the catch is responsibility. Developers now have
to handle all the things Google used to manage security
for that payment, flow, tax compliance, customer service issues related
to that payment.

Speaker 1 (02:26):
Ah. Okay, so the burden shifts precisely.

Speaker 2 (02:29):
It's not just free money, it's freedom with significant new
operational requirements.

Speaker 1 (02:34):
Now this is where comparing it to Apple gets really interesting,
because Apple also had a ruling from Epic Games forcing
them to allow external links, right.

Speaker 2 (02:43):
But Apple's reaction was very different. As soon as they
had to allow links, they threw up major roadblocks.

Speaker 1 (02:49):
Well kind of roadblocks.

Speaker 2 (02:50):
Two big ones. First, these mandatory warning screens basically trying
to scare users off from clicking the external link.

Speaker 1 (02:56):
Right, the scare screens.

Speaker 2 (02:57):
And second, this is the real kicker. They introduced a
new do twenty seven percent commission on purchases made through
those external links.

Speaker 1 (03:04):
Wait, twenty seven percent. That's only three percent less than
their standard cut.

Speaker 2 (03:07):
Exactly. It barely made it worth the effort for many developers,
and Apple is still trying to collect commissions on external
payments like they're pursuing with Fortnite.

Speaker 1 (03:18):
So the Google ruling is much stronger than Google is
explicitly barred from charging any commission on these external US sales.

Speaker 2 (03:26):
That's the key distinction. Zero commission from Google on fully
external transactions in the US versus Apple's twenty seven percent.
It's a massive difference. We're talking potentially saving your full
fifteen percent or thirty percent cut for US users, not
just a tiny three percent discount.

Speaker 1 (03:43):
That gives Android developers a potentially huge advantage in the
US market monetization.

Speaker 2 (03:48):
Wise, monumental architecturally speaking. But you know, let's connect this
to the bigger picture. Savvy developers haven't just been sitting
around waiting for court rulings.

Speaker 1 (03:56):
Good point. There were existing ways to handle payments outside
the app stores, right, client ways.

Speaker 2 (04:00):
Absolutely, we should probably touch on those because they're still
relevant globally, not just under these new US rules.

Speaker 1 (04:05):
Yeah, give us the one down. What were developers already doing?

Speaker 2 (04:08):
Okay, first, the easy one, physical goods and services think Uber,
door Dash, maybe renting a scooter. If the app facilitates
a real world transaction, not a digital good, you could
always use external payment systems without paying the commission. That's
always been allowed.

Speaker 1 (04:24):
Okay, that makes sense, But digital goods subscriptions, that's where
the big commissions were how did apps like say Netflix
or Spotify handle that?

Speaker 2 (04:32):
Ah the classic reader app or weblog in bypass strategy,
it's pretty clever. You handle all the payment processing completely outside.

Speaker 1 (04:40):
The app, so on your website exactly.

Speaker 2 (04:42):
User goes to your website, creates an account, puts in
their credit cards, subscribes, then they download the app and
simply log in to access the premium features they already
paid for.

Speaker 1 (04:51):
And the key restriction there was you couldn't tell people
inside the app to go pay on the website precisely.

Speaker 2 (04:57):
No button saying subscribe here, no direct LI links within
the app interface itself. You had to rely on users
finding your website independently.

Speaker 1 (05:05):
But the new US ruling removes that specific restriction. Now
you can put the link inside the app.

Speaker 2 (05:11):
Yes, for the US market, that restriction on in app
solicitation for external payments is lifted by this ruling, but
the basic architecture processing the payment externally remains a very
effective model worldwide if you want to maximize revenue, and.

Speaker 1 (05:26):
Then there's the option of just avoiding the Playstore altogether.

Speaker 2 (05:29):
Right alternative distribution. You can publish on the Amazon App Store,
the Samsung Galaxy Store, or even offer your APK directly
from your own website for users to download and install.
That's called sideloading.

Speaker 1 (05:41):
That bypasses Google's fees entirely.

Speaker 2 (05:44):
It does. But and this is where we pivot hard
into security. Doing that, that means you give up everything
Google provides.

Speaker 1 (05:50):
Okay, let's talk about that. Because pushing users outside playbilling
or distributing directly, that sounds like it opens up a
lot of security risks.

Speaker 2 (05:59):
It absolutely, you dramatically increase your tax surface, You lose
Google's built in security scanning, their update mechanism, potentially their
license verification.

Speaker 1 (06:08):
So if you go the sideloading route, you're on your
own for patching vulnerabilities, detecting, tampering everything pretty much.

Speaker 2 (06:15):
And even if you just use external payments but stay
in the play Store, you introduce new risks. Redirection attacks
where users are sent to fake payment pages, man in
the middle attacks, intercepting data.

Speaker 1 (06:25):
Unauthorized clients trying to hit your back end APIs after
bypassing the payment maybe.

Speaker 2 (06:30):
Exactly, bots, scrapers, fraud the works. The bottom line is,
if you take control of the payment flow, you must
take control of the security around it. You need robust
API security and ways to ensure your app hasn't been
messed with.

Speaker 1 (06:44):
This sounds like where app integrity becomes absolutely critical, even
if the payment happens elsewhere. You mentioned the play Integrity API.
How does that fit in?

Speaker 2 (06:52):
It's more crucial than ever. Developers need to be using
the play Integrity API proactively. Now think of it this way.
The API verifies that the request to show that external
payment link, or the request access premium content after payment
is coming from your genuine, untampered app, not from.

Speaker 1 (07:08):
Some pirated version or an app running on a rooted
device or emulator.

Speaker 2 (07:12):
Precisely, it checks the integrity of the app and the
device environment before you proceed with the sensitive action like
displaying that external checkout link.

Speaker 1 (07:21):
So the check happens before you even send the user
off to pay.

Speaker 2 (07:24):
Ideally, yes, you attest the client first. If the integrity
chack fails, maybe detects rooting an emulator, known mailware, or
that the app signature doesn't match the play Store version,
you just block that flow, don't show the link, don't
grant access.

Speaker 1 (07:40):
That seems essential for protecting the revenue. Even if the
transaction itself is external, you need to trust the source
of the request exactly.

Speaker 2 (07:47):
It helps block fraud abuse bots trying its great premium content.
It ensures the traffic hitting your external payment provider or
accessing paid features is actually coming from a legitimate user
with your real app.

Speaker 1 (08:00):
Okay, this definitely feels like a step up in complexity
for development and security teams. Is Google offering any guidance here,
any principles they expect developers to follow in this more
open payment.

Speaker 2 (08:11):
Work they are They've outlined what they call the safe principles.
If you're going to use external billing, you really need
to understand it adhere to these. It's about maintaining trust.

Speaker 1 (08:21):
Safe principles, right, we should probably define those. What does
safe stand for?

Speaker 2 (08:26):
Okay? S is for security robust protection against data breaches,
fraud malware within your payment flow. A is for auditing.
You need transparency, adherence to payment standards like pcideas as
if applicable makes sense. F F is flexibility offering users
clear choices in payment methods, and E is enforcement. Basically,
you have to handle customer service refunds disputes responsibly, maintaining

(08:50):
high standards consistent with what users expect.

Speaker 1 (08:52):
So security, auditing, flexibility, enforcement, it really shifts the onus
onto the developer to manage that entire external process safely
and transparently.

Speaker 2 (09:01):
Absolutely, the legal and technical responsibility is now squarely on
your shoulders if you choose that path.

Speaker 1 (09:06):
So the big takeaway here seems to be, Yes, there's
new freedom for monetization in the US thanks to the courts.

Speaker 2 (09:12):
But it comes packaged with a huge increase in responsibility,
especially around security and user trust.

Speaker 1 (09:18):
That fragmented payment landscape means developers really have to own
application integrity and API security like never before. You can't
just rely on the store's infrastructure anymore.

Speaker 2 (09:29):
You really can't, and that brings up a critical question
for you, the developers listening, to really think about, how
are you going to manage the user experience and the
security consistently when users might be interacting with your app
internally one minute and an external web portal the next. Yeah.

Speaker 1 (09:44):
Maintaining that seamless trust and security across different environments, that's
the new challenge. The days of just letting the app
store handle the tricky parts of the transaction seem to
be ending, at least in the US.

Speaker 2 (09:56):
It's a new era for sure, more control, but definitely
more work.

Speaker 1 (10:00):
Definitely something for everyone to maul over. Thanks for breaking
that down for us my pleasure.

Speaker 2 (10:04):
Always interesting developments in this space.

Speaker 1 (10:06):
This discussion was created using human expert analysis and research,
and it was assisted by AI technology.
Advertise With Us

Popular Podcasts

Stuff You Should Know
Las Culturistas with Matt Rogers and Bowen Yang

Las Culturistas with Matt Rogers and Bowen Yang

Ding dong! Join your culture consultants, Matt Rogers and Bowen Yang, on an unforgettable journey into the beating heart of CULTURE. Alongside sizzling special guests, they GET INTO the hottest pop-culture moments of the day and the formative cultural experiences that turned them into Culturistas. Produced by the Big Money Players Network and iHeartRadio.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.