Android Security: Why Google's Demands For Updates Don't Go Far Enough

A minimum of five updates in two years just doesn’t cut it.

- Michael Simon

If there’s one thing about Android that Google desperately wants to fix, it’s updates. Unless you’re buying a Pixel or an Android One phone, you’re never really sure whether you’re going to get updates as they’re available or, really, at all.

It’s a question whether you’re buying a thousand-dollar Galaxy Note 9 or something much cheaper: What’s going to happen to my phone in 6, 12, or 24 months?

Now Google is trying to make sure everyone has the same answer to that question. According to a report in The Verge (go.pcworld.com/2yrs), Google’s latest Android partner contract finally includes language that mandates security updates for a minimum of two years, lest the OEM in question lose future phone approval.

That all sounds well and good on paper, but it’s not like Google is playing hardball here. The requirements are about as light as they can be and apply to a relatively small subset of phones. As The Verge reports, the terms:

1. Cover devices launched after January 31, 2018;

2. Apply to phones with at least 100,000 activations;

3. Stipulate only quarterly security updates for the first year;

4. Place no minimum on security updates in the second year; and

5. Make no mention of version updates.