Apple and Google tighten and reshape app distribution through geoblocking and alternative app store programs
Apple began restricting US App Store access to certain ByteDance-owned apps, using increasingly sophisticated location-determination and geoblocking mechanisms. Reporting highlighted Apple’s use of signals such as GPS, Wi‑Fi country codes, SIM information, and potentially IP-based location checks (as reflected in App Store legal terms) to decide whether apps subject to regional legal restrictions can be offered; some users reported partial workarounds via VPNs, though results are inconsistent.
Google announced Play Store policy changes following its settlement of the Epic Games dispute, expanding developer billing options, adjusting fee structures, and introducing a Registered App Stores program to streamline installation of third-party Android app stores that meet Google’s safety/quality requirements. The rollout is staged by region (starting in the EEA/UK/US), and is positioned as enabling more alternative distribution while maintaining payment and ecosystem security controls—an approach that contrasts with Apple’s tighter, location-enforced gating of app availability and marketplace access.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
Google to complete global Play policy rollout
Google said the revised Play Store policies will reach the rest of the world by September 2027. This marks the final stage of the global rollout announced after the Epic Games settlement.
Google to expand revised Play policies to Japan and South Korea
Google said Japan and South Korea will receive the new Play Store policy framework by the end of 2026. This continues the phased global rollout of the settlement terms.
Google plans major Android release for Registered App Stores program
Google said the Registered App Stores program will begin outside the US first and may later expand to the US pending court approval. The company tied the program to a major Android release expected by the end of 2026.
Google to expand new Play policies to Australia
Google said it will extend the revised Play Store policies to Australia in September 2026 as part of the settlement rollout. The expansion follows the initial launch in the EEA, UK, and US.
Google to begin Play policy rollout in EEA, UK, and US
Google said the first phase of its new Play Store policy changes will start in the European Economic Area, the United Kingdom, and the United States by June 30, 2026. This phase includes allowing developers to use their own billing systems alongside Google Play billing and to direct users to complete purchases outside the app.
Apple blocks US downloads of ByteDance's Chinese apps
Ars Technica reported that Apple users in the United States could no longer download ByteDance's Chinese apps. The reference does not provide a more specific event date, so the publication date is used.
Google agrees to change Play Store policies in Epic Games settlement
Google said it will revise Google Play policies as part of a settlement in its legal dispute with Epic Games. The changes include expanded billing options, reduced fees through new developer programs, and a Registered App Stores program.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple and Google Tighten Mobile App Controls Through Telemetry and Sideloading Limits
Apple introduced **Personalized Collections** in the App Store, a recommendation feature built on detailed user telemetry that researchers at Mysk said logs every tap, app usage pattern, downloads, and potentially behavioral signals such as typing speed. The researchers reported that this analytics collection cannot be disabled and that related records appear in Apple account data exports from `privacy.apple.com`, prompting criticism over the granularity of the data and the lack of an opt-in model for personalization. Google separately outlined a stricter Android sideloading process called **Advanced Flow** for apps from unverified developers, adding several barriers including developer mode activation, anti-coaching checks, a device restart with reauthentication, biometric or PIN confirmation, and a mandatory 24-hour waiting period. Google said internet-sideloaded apps are linked to far higher malware rates than Play-distributed apps and plans to deliver the controls through Google Play Services, but the move has also raised concerns that the company is using security justifications to further centralize control over how users discover and install mobile apps.
Jun 29, 2026
Regulatory Pressure on Apple's App Store and Platform Control
Apple is facing increasing regulatory scrutiny over its control of the iOS ecosystem, with authorities in multiple regions demanding changes to its longstanding practices. In the UK, the Competition and Markets Authority (CMA) has ruled that Apple holds a strategic market status, effectively a monopoly, and may soon require the company to allow rival app stores on iPhones. This would mark a significant shift from Apple's current "walled garden" approach, which has prioritized security and privacy by restricting app distribution to its own vetted App Store. The potential introduction of competing app stores could lower fees for developers and increase consumer choice, but also raises concerns about the impact on iPhone security and privacy standards. Meanwhile, in Russia, the Federal Antimonopoly Service (FAS) has ordered Apple to make a Russian search engine, such as Yandex or Mail.ru, the default on devices sold locally, citing violations of consumer protection laws and competitive disadvantage for domestic providers. Apple has been given a deadline to comply or face penalties, with officials referencing Google's previous compliance with similar demands. These regulatory actions reflect a broader trend of governments challenging Apple's dominance and seeking to impose local requirements on its platform, potentially reshaping the user experience and security landscape for iOS devices worldwide.
Jun 29, 2026
Apple Expands App Store Age Assurance and 18+ Download Restrictions
Apple introduced expanded *age assurance* capabilities for the App Store to support compliance with new or emerging regulations in multiple jurisdictions, including Brazil, Australia, Singapore, Utah, and Louisiana. As of **Feb. 24, 2026**, Apple began blocking downloads of **18+ rated apps** in Brazil, Australia, and Singapore unless the user is confirmed to be an adult, using what Apple describes as “reasonable methods” for age confirmation. Apple also expanded the **Declared Age Range API** (iOS/iPadOS/macOS) and related platform components (including PermissionKit’s *Significant Change API*, a new StoreKit age-rating property type, and App Store Server Notifications) to provide developers with an age category plus signals about the assurance method and whether regulatory requirements apply; in Brazil, certain disclosures (e.g., loot boxes) can drive an app’s rating to **18+**. Broader policy debate continues around online age assurance in the U.S. and internationally, with jurisdictions adopting or considering stricter mandates and platforms preparing new verification requirements. Public skepticism remains elevated due to backlash against age-gating (including reported VPN usage spikes in response to the UK’s requirements) and concerns about data security following breaches at age-verification providers (e.g., **Sumsub** disclosing a previously undetected 2024 compromise). The policy environment is also being shaped by U.S. state laws and litigation, including the Supreme Court’s decision in *Free Speech Coalition v. Paxton* upholding Texas’s age verification law, while proponents argue that privacy-preserving age assurance approaches are becoming more technically mature and scalable.
Jun 29, 2026