Google has clarified that its newly introduced Android System SafetyCore does not perform client-side content scanning.
“Android includes multiple on-device protections to safeguard users from threats like malware, spam, and scam attempts while ensuring privacy and user control over their data,” a Google spokesperson told The Hacker News.
“SafetyCore is a new system service for Android 9+ devices that provides a secure, private on-device infrastructure for classifying content. It only classifies specific content when an app requests it through an optionally enabled feature, keeping users in control of the process.”
What is SafetyCore?
First introduced in October 2024, SafetyCore (package name: com.google.android.safetycore) is part of Google’s broader security measures aimed at combating scams and sensitive content, particularly within the Google Messages app.
The feature, which requires at least 2GB of RAM, is gradually rolling out to all Android devices running Android 9 and later, including those using Android Go, a lightweight version of the operating system designed for entry-level smartphones.
How is SafetyCore Different from Client-Side Scanning?
Unlike Client-Side Scanning (CSS), which analyzes on-device data and has raised privacy concerns, SafetyCore does not weaken encryption or introduce backdoors. CSS has been controversial due to its potential for abuse—allowing service providers to scan for content beyond its intended scope.
Google’s Sensitive Content Warnings in Messages work similarly to Apple’s Communication Safety in iMessage, leveraging on-device machine learning to detect potentially inappropriate content, such as nudity in photos and videos.
GrapheneOS Maintainers Clarify SafetyCore’s Purpose
Security experts from GrapheneOS, a privacy-focused operating system, reaffirmed that SafetyCore does not perform client-side scanning. Instead, it serves as an on-device machine learning framework that apps can use to classify content as spam, scams, or malware.
“Classifying content in this way is not the same as scanning for illegal material and reporting it to a service,” GrapheneOS developers stated on X (formerly Twitter). “That would be a significant privacy violation and could lead to false positives. SafetyCore is not designed for that purpose and cannot be used in that way.”
Final Thoughts
With SafetyCore, Google aims to enhance on-device security and content classification while prioritizing user privacy and control. As the feature continues to roll out, it will help Android users detect and filter out unwanted content without compromising their personal data.