Android Instant Apps

For instant apps that include login functionality, developers must integrate Smart Lock for Passwords.

Android Instant Apps developers are required to properly support links for other apps. If the developer’s instant app(s) or installed app(s) contains links that have the potential to resolve to an instant app, the developer must send users to that instant app, rather than, for example, capturing the links in a WebView.

Developers must comply with the Android Instant Apps technical specifications and requirements provided by Google, as may be amended from time to time, including those listed in our public documentation.

The instant app may offer the user the installable app, but this must not be the instant app's primary purpose. When offering installation, developers must:

• Use the Material Design 'get app' icon and the label 'install' for the installation button.
• Not have more than 2–3 implicit installation prompts in their instant app.
• Not use a banner or other ad-like technique for presenting an installation prompt to users.

Additional instant app details and UX guidelines can be found in the Best practices for user experience.

Instant apps must not make changes to the user’s device that persist longer than the instant app session. For example, instant apps may not change the user’s wallpaper or create a home screen widget.

Developers must ensure that instant apps are visible to the user, such that the user is aware at all times that the instant app is running on their device.

Instant apps are prohibited from accessing device identifiers that both (1) persist after the instant app stops running and (2) are not resettable by the user. Examples include, but are not limited to:

• Build Serial
• Mac Addresses of any networking chips
• IMEI, IMSI

Instant apps may access phone numbers if obtained using the runtime permission. The developer must not attempt to fingerprint the user by using these identifiers, or any other means.

Network traffic from inside the instant app must be encrypted using a TLS protocol like HTTPS.