Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
Welcome to upwardly Mobile API and app Security. I'm your host,
joined by our expert contributor.
Speaker 2 (00:06):
Great to be here.
Speaker 1 (00:07):
Today. We're looking at something massive, a real shakeup in
mobile monetization. The Supreme Court's decision forcing Google to open
the play Store to third party payments in the US.
Speaker 2 (00:18):
Yeah, this is a big one. It's got huge implications
not just for how you make money, but for compliance
and crucially for security for everyone. Really, iOS, Android, Flutter, React,
Native developers.
Speaker 1 (00:32):
Absolutely, And our goal today is to well break down
what this actually means technically, how developers can navigate this
new landscape and.
Speaker 2 (00:40):
Compared to what Apple phaced earlier, because the rules aren't
quite the same and that difference matters.
Speaker 1 (00:45):
Okay, let's unpack this. So the core issue was the
Epic Games lawsuit, right. They argued Google had an illegal monopoly.
Speaker 2 (00:51):
With play billing exactly, and Google fight it all the
way to the Supreme Court, which basically said nope, appeal rejected.
So now Google has to follow that original District Court injunction.
Speaker 1 (01:00):
And that injunction changes things immediately. What are the key
dates developers need to know?
Speaker 2 (01:05):
Well, technically it's effective now, but the real implementation deadlines
seem to be clustering around late October twenty twenty five.
October twenty ninth is the date mentioned. Okay, and these
specific terms, they're said to expire November first, twenty twenty seven.
For now, it's just US customers.
Speaker 1 (01:23):
Remember, right, US only for now? But what can developers
actually do differently?
Speaker 2 (01:28):
This is the fascinating part. Developers can now tell users
straight up, hey, you can pay less on our website.
They can put direct links in the app to their
own checkout pages.
Speaker 1 (01:38):
WHOA, okay, so no more vagants. You can just link
out directly.
Speaker 2 (01:42):
Yep, link out. Offer different payment methods, credit card, PayPal,
whatever system you use, completely outside of Google Play billing.
Google can't enforce that billing exclusivity in the US anymore.
Speaker 1 (01:52):
Or penalize you for promoting external payments.
Speaker 2 (01:55):
Correct, that restriction has gone in the US market.
Speaker 1 (01:57):
That sounds incredibly good for developers, almost too good. If
Google can't take a cut from these external sales, why
wouldn't everyone just switch immediately? Isn't there some catch?
Speaker 2 (02:07):
Well? Yes and no. The ruling does bar Google from
charging commissions on those external purchases, which is, like you said,
revolutionary okay, But the catch is responsibility. Developers now have
to handle all the things Google used to manage security
for that payment, flow, tax compliance, customer service issues related
to that payment.
Speaker 1 (02:26):
Ah. Okay, so the burden shifts precisely.
Speaker 2 (02:29):
It's not just free money, it's freedom with significant new
operational requirements.
Speaker 1 (02:34):
Now this is where comparing it to Apple gets really interesting,
because Apple also had a ruling from Epic Games forcing
them to allow external links, right.
Speaker 2 (02:43):
But Apple's reaction was very different. As soon as they
had to allow links, they threw up major roadblocks.
Speaker 1 (02:49):
Well kind of roadblocks.
Speaker 2 (02:50):
Two big ones. First, these mandatory warning screens basically trying
to scare users off from clicking the external link.
Speaker 1 (02:56):
Right, the scare screens.
Speaker 2 (02:57):
And second, this is the real kicker. They introduced a
new do twenty seven percent commission on purchases made through
those external links.
Speaker 1 (03:04):
Wait, twenty seven percent. That's only three percent less than
their standard cut.
Speaker 2 (03:07):
Exactly. It barely made it worth the effort for many developers,
and Apple is still trying to collect commissions on external
payments like they're pursuing with Fortnite.
Speaker 1 (03:18):
So the Google ruling is much stronger than Google is
explicitly barred from charging any commission on these external US sales.
Speaker 2 (03:26):
That's the key distinction. Zero commission from Google on fully
external transactions in the US versus Apple's twenty seven percent.
It's a massive difference. We're talking potentially saving your full
fifteen percent or thirty percent cut for US users, not
just a tiny three percent discount.
Speaker 1 (03:43):
That gives Android developers a potentially huge advantage in the
US market monetization.
Speaker 2 (03:48):
Wise, monumental architecturally speaking. But you know, let's connect this
to the bigger picture. Savvy developers haven't just been sitting
around waiting for court rulings.
Speaker 1 (03:56):
Good point. There were existing ways to handle payments outside
the app stores, right, client ways.
Speaker 2 (04:00):
Absolutely, we should probably touch on those because they're still
relevant globally, not just under these new US rules.
Speaker 1 (04:05):
Yeah, give us the one down. What were developers already doing?
Speaker 2 (04:08):
Okay, first, the easy one, physical goods and services think Uber,
door Dash, maybe renting a scooter. If the app facilitates
a real world transaction, not a digital good, you could
always use external payment systems without paying the commission. That's
always been allowed.
Speaker 1 (04:24):
Okay, that makes sense, But digital goods subscriptions, that's where
the big commissions were how did apps like say Netflix
or Spotify handle that?
Speaker 2 (04:32):
Ah the classic reader app or weblog in bypass strategy,
it's pretty clever. You handle all the payment processing completely outside.
Speaker 1 (04:40):
The app, so on your website exactly.
Speaker 2 (04:42):
User goes to your website, creates an account, puts in
their credit cards, subscribes, then they download the app and
simply log in to access the premium features they already
paid for.
Speaker 1 (04:51):
And the key restriction there was you couldn't tell people
inside the app to go pay on the website precisely.
Speaker 2 (04:57):
No button saying subscribe here, no direct LI links within
the app interface itself. You had to rely on users
finding your website independently.
Speaker 1 (05:05):
But the new US ruling removes that specific restriction. Now
you can put the link inside the app.
Speaker 2 (05:11):
Yes, for the US market, that restriction on in app
solicitation for external payments is lifted by this ruling, but
the basic architecture processing the payment externally remains a very
effective model worldwide if you want to maximize revenue, and.
Speaker 1 (05:26):
Then there's the option of just avoiding the Playstore altogether.
Speaker 2 (05:29):
Right alternative distribution. You can publish on the Amazon App Store,
the Samsung Galaxy Store, or even offer your APK directly
from your own website for users to download and install.
That's called sideloading.
Speaker 1 (05:41):
That bypasses Google's fees entirely.
Speaker 2 (05:44):
It does. But and this is where we pivot hard
into security. Doing that, that means you give up everything
Google provides.
Speaker 1 (05:50):
Okay, let's talk about that. Because pushing users outside playbilling
or distributing directly, that sounds like it opens up a
lot of security risks.
Speaker 2 (05:59):
It absolutely, you dramatically increase your tax surface, You lose
Google's built in security scanning, their update mechanism, potentially their
license verification.
Speaker 1 (06:08):
So if you go the sideloading route, you're on your
own for patching vulnerabilities, detecting, tampering everything pretty much.
Speaker 2 (06:15):
And even if you just use external payments but stay
in the play Store, you introduce new risks. Redirection attacks
where users are sent to fake payment pages, man in
the middle attacks, intercepting data.
Speaker 1 (06:25):
Unauthorized clients trying to hit your back end APIs after
bypassing the payment maybe.
Speaker 2 (06:30):
Exactly, bots, scrapers, fraud the works. The bottom line is,
if you take control of the payment flow, you must
take control of the security around it. You need robust
API security and ways to ensure your app hasn't been
messed with.
Speaker 1 (06:44):
This sounds like where app integrity becomes absolutely critical, even
if the payment happens elsewhere. You mentioned the play Integrity API.
How does that fit in?
Speaker 2 (06:52):
It's more crucial than ever. Developers need to be using
the play Integrity API proactively. Now think of it this way.
The API verifies that the request to show that external
payment link, or the request access premium content after payment
is coming from your genuine, untampered app, not from.
Speaker 1 (07:08):
Some pirated version or an app running on a rooted
device or emulator.
Speaker 2 (07:12):
Precisely, it checks the integrity of the app and the
device environment before you proceed with the sensitive action like
displaying that external checkout link.
Speaker 1 (07:21):
So the check happens before you even send the user
off to pay.
Speaker 2 (07:24):
Ideally, yes, you attest the client first. If the integrity
chack fails, maybe detects rooting an emulator, known mailware, or
that the app signature doesn't match the play Store version,
you just block that flow, don't show the link, don't
grant access.
Speaker 1 (07:40):
That seems essential for protecting the revenue. Even if the
transaction itself is external, you need to trust the source
of the request exactly.
Speaker 2 (07:47):
It helps block fraud abuse bots trying its great premium content.
It ensures the traffic hitting your external payment provider or
accessing paid features is actually coming from a legitimate user
with your real app.
Speaker 1 (08:00):
Okay, this definitely feels like a step up in complexity
for development and security teams. Is Google offering any guidance here,
any principles they expect developers to follow in this more
open payment.
Speaker 2 (08:11):
Work they are They've outlined what they call the safe principles.
If you're going to use external billing, you really need
to understand it adhere to these. It's about maintaining trust.
Speaker 1 (08:21):
Safe principles, right, we should probably define those. What does
safe stand for?
Speaker 2 (08:26):
Okay? S is for security robust protection against data breaches,
fraud malware within your payment flow. A is for auditing.
You need transparency, adherence to payment standards like pcideas as
if applicable makes sense. F F is flexibility offering users
clear choices in payment methods, and E is enforcement. Basically,
you have to handle customer service refunds disputes responsibly, maintaining
(08:50):
high standards consistent with what users expect.
Speaker 1 (08:52):
So security, auditing, flexibility, enforcement, it really shifts the onus
onto the developer to manage that entire external process safely
and transparently.
Speaker 2 (09:01):
Absolutely, the legal and technical responsibility is now squarely on
your shoulders if you choose that path.
Speaker 1 (09:06):
So the big takeaway here seems to be, Yes, there's
new freedom for monetization in the US thanks to the courts.
Speaker 2 (09:12):
But it comes packaged with a huge increase in responsibility,
especially around security and user trust.
Speaker 1 (09:18):
That fragmented payment landscape means developers really have to own
application integrity and API security like never before. You can't
just rely on the store's infrastructure anymore.
Speaker 2 (09:29):
You really can't, and that brings up a critical question
for you, the developers listening, to really think about, how
are you going to manage the user experience and the
security consistently when users might be interacting with your app
internally one minute and an external web portal the next. Yeah.
Speaker 1 (09:44):
Maintaining that seamless trust and security across different environments, that's
the new challenge. The days of just letting the app
store handle the tricky parts of the transaction seem to
be ending, at least in the US.
Speaker 2 (09:56):
It's a new era for sure, more control, but definitely
more work.
Speaker 1 (10:00):
Definitely something for everyone to maul over. Thanks for breaking
that down for us my pleasure.
Speaker 2 (10:04):
Always interesting developments in this space.
Speaker 1 (10:06):
This discussion was created using human expert analysis and research,
and it was assisted by AI technology.