DeviceCheck helps assess particular device-related state. Application integrity, promotion abuse and user authorization are different questions, so do not confuse it with App Attest.
Evaluation approach
The service's state information can support a business rule that tracks whether a benefit has already been used. The server must define its meaning and update policy.
Application example
In a trial promotion, consider device state alongside account and transaction history. Provide a correction path for a new device owner or a support exception.
Limits and considerations
Using device state as a permanent personal identity can produce incorrect outcomes and privacy problems.
Limited data for a limited purpose
DeviceCheck capabilities do not have the same meaning as App Attest application-integrity evidence. Define on the server what the device-related state represents. Product labels are not a basis for treating the services as interchangeable.
A record used to assess promotion abuse should not be the sole reason for an account sanction. Review phone ownership changes and legitimate reinstallation. Specify who may change the state and which business event triggers an update.
Checks and decisions
- Document the state's meaning
- Define a correction path
- Combine account signals
State clearly which abuse decision the service supports.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.