Google Play's 2027 quality mandates: the memory limits and zero-tap sign-in you need to plan for now

In August 2026, Google announced new Play technical quality requirements with enforcement dates in 2027. If you maintain an Android app, these are now on your roadmap whether you like it or not — the work takes months, and the metered windows mean "we'll optimize later" has a real deadline.

What's coming

February 2027 — memory usage + code optimization. Google Play will enforce thresholds measured through Android Vitals (90th percentile over your install base): dynamic memory per app state and device-RAM tier, bitmap memory held in background/cached states, and DEX code optimization coverage of at least 25% across optimization, shrinking, and obfuscation (R8 or equivalent). Fall over the thresholds repeatedly and you lose store visibility and publishing capability — not a delisting, but the next best thing to invisible.

April 2027 — zero-tap sign-in. Apps with sign-in must restore the user's sign-in state on a new device via the Android Restore Credentials API (Credential Manager). When your user gets a new phone, your app should just be signed in. Games are exempt from this one (memory and DEX rules still apply to them).

Why this matters before 2027

The memory thresholds are measured over a 28-day window. That makes early January 2027 the real deadline for the February enforcement — if your app is over the line in December, you don't have time to fix-measure-verify before the meter starts counting. Start the work this quarter.

The practical checklist

Memory:

1. Open Android Vitals and find where you actually stand on the memory metrics today — most devs have never looked.
2. Hunt the usual suspects: bitmaps retained in background, static references to activities/contexts, listeners never unregistered, images loaded at full resolution into small views.
3. Downsample aggressively, use a proper image loader (Coil/Glide) with sane caching, and release bitmap-heavy resources in onTrimMemory(TRIM_MEMORY_UI_HIDDEN).
4. Test on low-RAM devices, not just your flagship — the thresholds are per RAM tier.

DEX optimization:

1. Turn on R8 properly: minifyEnabled + shrinkResources, then verify the 25% coverage with APK Analyzer. The classic footguns are missing keep rules for reflection, serialization, and JNI — test your release build, not just debug.

Zero-tap sign-in:

1. Integrate the Restore Credentials flow: create the credential on sign-in, restore it on first launch on a new device, handle the key lifecycle (rotation, revocation). Test the two-device flow on real hardware or emulators.

The full kit

I've packaged this into a complete 2027-readiness kit: the 5-question "are you affected" self-check, the official threshold tables, the memory action plan with leak patterns and fixes, the R8 configuration guide with the 5 breakage pitfalls, the Restore Credentials 9-item integration checklist, a week-by-week roadmap from now to April 2027, and copy-paste verification commands: https://8286544375711.gumroad.com/l/yagjbej

Disclosure: the kit is a paid $29 product. Everything in this article is free and standalone — the kit is for people who want the complete implementation checklist in one place.

(Independent guide — not affiliated with Google. Verify thresholds and dates against the official announcement and Play Console Help; policy details evolve.)