Last week, we reported that Google had begun to lock users out of Google Apps on what it dubbed "uncertified" Android devices, by blocking sign-in of Google accounts during setup and displaying a "Device is not certified by Google" error message. Today, we confirmed with Google that this is an intended behavior. There's even a website detailing what a "Certified by Google" Android device is now.
Here is Google's official statement:
Certified Android devices offer users consistent experiences when using apps from Google and the Play Store, as well as various security benefits through Google Play Protect. We acknowledge that some manufacturers are building and selling devices that have not been certified by Google. Please see the website for more details.
So, there's your policy going forward: devices not certified with Google will be actively barred from signing into Google Apps.
Why wouldn't a device be certified? There are a number of reasons, but the most common is that the manufacturer doesn't want to deal with meeting Google's compatibility requirements and undergoing the necessary testing (the Android Compatibility Test Suite, or CTS) to be approved as a Google Mobile Services partner. While there is no major cost associated with becoming a GMS partner, it isn't trivial, and fly-by-night manufacturers are probably more concerned with churning out as many phones and tablets as cheaply and quickly as possible. Google certification is, for these companies, a barrier to doing business.
The other reason is that you're using a custom ROM on your phone or tablet, and Google considers such software uncertified because it hasn't been tested by Google itself. Whatever the reason, getting around this issue is accomplished in the same way. (Of note: If you're receiving this message and believe you're running certified software, it may be because your device's bootloader is unlocked. You can re-lock your bootloader and everything should be good.)
How to unblock Google Apps on an uncertified phone or tablet
Google isn't talking about it, but there is an exemption provided for that will allow you to bypass the block. During sign-in, a dialogue will be presented sending you to this website. The dialogue says this is for phones with custom ROMs, but to be clear, Google has no way of checking this - they just want to discourage people from buying uncertified phones.
If you're seeing the error message above, you're either using a phone with a custom ROM or software that hasn't been certified by Google. Google will allow you to exempt your device from the block by submitting what's known as a 'Google Services Framework ID' on this page. You must be signed in with the Google account on this page that you plan to use on the phone. Once your ID is submitted, that device will be allowed to sign into Google Apps.
Your next question would likely be just what a GSF ID is. The GSF ID is a unique identifier generated by Google Play Services. Every time you factory reset your device, a new GSF ID is generated, so you'll need to register it again.
How to retrieve the (right) ID - Google Services Framework
How do you get the Google Services Framework ID? Well, there are apps out there that can pull it - we recommend using one we trust from our sister site APK Mirror (link). You'll see the proper ID highlighted in the image below. In order to generate a GSF ID, Google Play Services must be installed on the device already.
Why is Google doing this?
Google claims this is to prevent potentially insecure or "incompatible" devices from using its apps or services, because doing so may result in a poor experience or potentially expose a user to security risks.
The reality is that while those things are potentially true, Google is mostly doing this to stop "gray market" Android devices that are shipped with unauthorized installations of its Google Apps package. These devices are common in certain countries, and Google wants to encourage the manufacturers of those products to work to receive Google certification.
Of course, in China - one of the largest markets for "uncertified" devices - this is impossible, as Google's apps and services are blocked throughout the country. And removing such a device from the block list means accessing a Google website that requires a Google account to sign in, effectively making it very difficult for users to get around this restriction.
In other regions, manufacturers could just streamline the process of finding the GSF by preloading an application that installs Play Services, retrieves it, and sends the user directly to the exemption page as part of the setup process. And we already know this sort of thing happens. Companies like Meizu, who lost their GMS certification some years back, basically direct users to a preinstalled third-party app store to download an illegitimate "Google Apps installer." This will add another layer to the process, but it's just that: another inconvenience to deal with for users, and one that will likely do little to deter the manufacturers who don't want to deal with certifying their devices.