I sideload a plethora of apps, and every install feels like it drags on a second longer than it should.
My inquisitive nature made me look for whatever was slowing things down, and Play Protect’s scanning was the obvious suspect. I turned off real-time scanning to see what I would gain.
Turns out, the answer was less exciting than I expected.
Before I dove into the test phase, I had to be a little more careful about what I was disabling, given that it was recently found out how far Google’s security settings reach.
What Play Protect’s real-time scanning actually covers
It’s two different jobs wearing the same name
You’ll find the toggle by going to Settings and Privacy > App Security > Google Play Protect, tapping the gear icon, and selecting Scan apps with Play Protect. The method may vary on some phones, but the setting is there by default.
It’s a single switch, but it controls two things.
The first is install-time scanning, which is a code-level check that runs on apps Play Protect hasn’t seen before, especially sideloaded ones.
The second is Live Threat Detection, an on-device AI system that monitors app behavior after installation and searches for signs of exploitation.
Android 17 expanded that second part extensively, which now also watches for apps that secretly forward SMS messages or abuse accessibility permissions.
Both processes happen on-device via Google’s Private Compute Core, so none of the scanning data is sent to the servers. This matters if you’re weighing it against privacy rather than speed.
There’s a second toggle most people miss
Improve harmful app detection works on its own
Turning off Scan apps with Play Protect doesn’t automatically touch the option sitting below it.
Improve Harmful App Detection is its own switch, and it decides whether sideloaded apps are sent to Google for inspection.
I left this option on the whole time, even when real-time scanning was off.
Most guides clump these options together, but they’re separate toggles with separate trade-offs. You can turn off the scan and still let Google check unfamiliar apps quietly in the background.
This is the middle ground I landed on without planning on it.
Why the tiny delay?
The lag lives in moments, not the entire day
The scan that happens during installation causes the noticeable pause, but only for apps that Play Protect hasn’t evaluated.
The lag disappears as soon as the app is known and trusted, and that check doesn’t repeat on every launch.
Live Threat Detection, on the flip side, is the ongoing part that runs quietly through Google’s Private Compute Core. However, the trade-offs were stricter than expected, which lines up with what I noticed.
According to Google, daily background scans of installed apps are scheduled when your phone is idle. It shouldn’t affect performance during normal use.
This led me to conclude that the slowdown I was chasing was never really a constant drag; it was a one-time tax on unfamiliar app installs.
What I actually gained by turning it off
A narrower win than I was hoping for
Sideloaded installations felt a bit snappier with scanning turned off, shaving maybe a second or two off each install.
Apart from that, there wasn’t a single change that affected me positively.
The scrolling wasn’t smoother than before, app switching was the same speed, and nothing related to performance. The speed bump was only noticed for apps that Play Protect hasn’t seen before, which is nothing major.
To be fair, a second or two off on an occasional app install isn’t worth losing Live Threat Detection’s ongoing behavior monitoring, especially with Android 17 actively watching for newer tricks like SMS forwarding.
This protection runs in the background, irrespective of whether I’m installing a new app or not.
The gap was real, but it was consistently small. Just a couple of seconds.
Why I turned it back on
The trade-off wasn’t close after I looked at both sides
Google agrees with me as well.
The system is designed so that the toggle can’t be turned off during phone or video calls, specifically because scammers try to talk people into disabling it mid-call to sideload something malicious.
This single protection told me more about the actual risk than any settings menu did. It’s the kind of silent protection that you don’t notice at first, until you’re at the end of a convincing call.
Android 17 has more of its already announced features rolling out, and I’d rather have them all running than save a second here and there on installs I barely do.
A second saved on a rare install isn’t worth trading your protection that is watching for newer scam alerts.
