UPDATED with the most recent malware-detection test results. This review was originally published Oct. 10, 2019.
As the native Android antivirus option, Google Play Protect should have a real edge over rival apps, given that it's already installed on your device. The main problem is that it gets consistently awful malware-detection results in third-party lab tests, and an antivirus solution that can't detect malware reliably isn't much good to anyone.
Take a look at Bitdefender Mobile Security if you are willing to pay for your Android antivirus solution, and the free version of Norton Mobile Security if you want strong malware protection without the additional cost. Both are on our list of best Android antivirus apps, while Google Play Protect isn't.
Google Play Protect costs and what's covered
If your Android device has Google Play, it has Google Play Protect. You can choose to turn the service off if you wish, but as of 2018, it is turned on by default on all new Google-provisioned Android devices.
To be clear, Google Play Protect is not a full antivirus solution like the other seven apps that I tested in early 2019, but it does try to protect your device from malware.
Technically, that is the extent of the functionality of Play Protect, but we'll cover Find My Device as well, since similar features are found in many of the antivirus apps that I tested, and this free native option is found in the same settings menu as Play Protect.
Naturally, Google isn't in the business of making antivirus software for non-Android platforms. For that kind of protection, check out our pages on the best Mac antivirus software and the best antivirus software overall.
Google Play Protect regularly scans the apps that are installed or updated on your device. You can choose to trigger a scan yourself by going to Settings > Security & Location > Google Play Protect, but there is no option to schedule a scan. This is in keeping with the general idea that Google Play Protect is always running in the background and monitoring for threats.
There were a few updates in the last year to enhance the functionality of Google Play Protect. The app will now notify you if you are installing what it deems to be a "new or rare app" – basically, an app that hasn't been seen often by Google's cloud-based systems will trigger a warning to the user to be cautious with whatever is being installed.
An update in 2019 brought contextual pop-up warnings when a potentially dangerous app is actually being launched. This was introduced to deal with notification fatigue, as sometimes users will dismiss warnings when they aren't directly associated with a user action, which could lead to potentially catastrophic results with malware.
Finally, Google Play Protect also gained the ability to flag apps on a user's device that had been removed from the Play Store due to violations of Google Play policies. Particularly egregious apps are disabled entirely. This feature won't remove the app from your device, but will recommend that you remove the app yourself.
Google Play Protect had a typically rough outing in German independent lab AV-TEST's July 2019 evaluations of Android security products. It detected only 44.1% of the 3,347 "real-time" online malware threats it faced, and 54.7% of the 3,433 malware samples that had been collected in the previous four weeks.
That's actually worse than in previous months. In May 2019, Google Play Protect detected 75.2% of real-time and 72.7% of widespread malware; in March 2019, its results were 62.0% and 69.2%, respectively.
Needless to say, these scores are all well below the industry averages, which were always 99.5% or above in both categories for all three rounds.
Of the other Android antivirus apps that I reviewed in 2019, five submitted to AV-TEST evaluations in March, May and July 2019.
Bitdefender Mobile Security and Norton Mobile Security each achieved 100/100 detection rates in all three months. Avast Mobile Security was next with perfect scores in May and July and 99.7/100 in March.
Kaspersky Mobile Antivirus, also known as Kaspersky Internet Security for Android, got perfect scores in March and statistically nearly identical scores of 99.9/100 in May and July. McAfee Mobile Security scored perfectly in May, 99.9/100 in July, but had an off month in March with 99.5/99.1.
Google Play Protect has never fared well in these evaluations. Since AV-TEST began evaluating the app in September 2017, its detection-rate percentages have fluctuated from the mid-40s to the high 70s.
That means that between 20% and 50% of malware is getting through, as opposed to 0.1% or 0.2% with most other products (and no malware at all with Norton). You cannot rely on Google Play Protect to protect your Android device from infection.
Two of the apps that I reviewed in 2019, Qihoo 360 Security and Lookout Security & Antivirus, no longer submit samples to AV-TEST for evaluation.
Google Play Protect did a bit less terrible in Austrian lab AV-Comparatives' July 2019 in-depth look at 11 Android antivirus apps. It detected 83.2% of real-time malware, which is still pretty bad. Avast, Bitdefender, Kaspersky and McAfee all detected 99.9%; Lookout, Norton and Qihoo 360 Security were not tested.
Security features and tools
There aren't any other features that are expressly part of Play Protect, but Google does offer a couple of other security features built into the operating system.
Find My Device
Available on Android devices since 2013, Find My Device covers the basics that most users want from an anti-theft solution. You can access the features from the app on another device that is logged into your Google account, by going to Android.com/find, or by simply typing "find my phone" into Google.com if you are signed into your Google account.
You can have a lost device play a sound for 5 minutes straight, even if the device is set to silent mode. You can remotely lock the device and display a message on the lock screen and/or provide a phone number.
If you do provide a phone number, a large green circle appears in the middle of the screen with a phone icon and tapping it will automatically call the number you provided. Finally, you can choose to erase the device completely, but only if you've given up on finding the phone, as you will no longer be able to track it after the wipe.
I tested every feature other than the full erase, and they all worked within 1-2 seconds of activating them via the app or website. Not every third-party Android antivirus app can claim such success.
Chrome Safe Browsing
Again, this isn't a part of Play Protect, but it is a free tool built into the Chrome Browser preinstalled on Android devices. Safe Browsing should be enabled by default, but you can verify that it is active by tapping the menu button in the upper-right corner of the Chrome app and selecting Settings > Privacy. The box next to "Safe Browsing" should have a blue checkmark.
That's all there is to it. I used a known malicious test site to verify that Chrome Safe Browsing could catch a variety of different potential malware and phishing attacks. Again, not every antivirus app I tested could do that.
To evaluate the impact of running Google Play Protect on my device, I conducted multiple tests using the Geekbench 4 Android benchmarking tool on my Google Pixel 3 running Android 9.0 Pie. First, I ran a number of tests to establish a baseline performance for the device while Google Play Protect was deactivated. Then I ran additional tests following reactivation and during a full scan with the antivirus app.
Android's system settings allowed me to disable Google Play Protect to establish a baseline. After I reactivated Play Protect, the device saw a 2.34% decrease in performance. A full scan resulted in a slightly greater 2.66% slowdown.
This put Google Play Protect in fourth place among the eight apps that I tested for post-installation system impact on installation, and first place for full-scan performance.
Given that this is a native piece of the operating system, it was a bit surprising not to see Google Play Protect perform better in the post-installation test, but overall the app had a fairly minimal impact.
Setup and support
If your Android device has the Google Play Store, then you have Google Play Protect. It is active by default and will make itself known only if it detects a threat.
Support, as is usually the case with Android, is up to your manufacturer, but you can check the Android support page to see if there's an answer there.
Play Protect doesn't have much of an interface, but as a native part of the operating system, it fits well with the rest of the settings. I quite like the design of the Find My Device app and web portal. Even the alert that pops up on your device lock screen is the best implementation among the apps that I tested.
We now have nearly two years of data to support the notion that you should definitely not rely on Google Play Protect as your only method of protection against malicious apps.
I wouldn't recommend disabling it, either. It has limited impact on your system, and I have faith that it will eradicate any malicious content that it does find on your device. But you need to augment it with an antivirus solution from our selection of best Android antivirus apps that has a stronger track record of finding emergent threats, such as Bitdefender Mobile Security or Norton Mobile Security.