Do App Attest and Play Integrity verify a device’s location?

No: Apple App Attest and Google Play Integrity tell you whether your app is genuine and the device is trustworthy, and neither says anything about where the device is, so location has to be established and bound to that attestation separately.

What they do verify

Play Integrity returns verdicts about the app, the device and the account. Google describes them as whether you are “interacting with your unmodified binary that Google Play recognizes,” whether the app “is running on a genuine certified Android device,” and whether the user installed or paid for the app on Google Play (Play Integrity overview).

App Attest is “a service that you use to validate the instance of your app running on a device” (Apple documentation). It creates a hardware-backed key and has Apple certify that the key belongs to a genuine instance of your app.

Neither returns, or vouches for, a location. Apple also notes that App Attest “can’t definitively pinpoint a device with a compromised operating system” (DeviceCheck).

Why they still matter for location

A location result is only as trustworthy as the software that produced it. If you know the app is unmodified and the device genuine, a location the app computes and signs is far harder to fake than one read from an untrusted environment. That is the idea behind device-attested location: use the platform’s attestation for the code and the hardware key, and compute the location inside that attested code.

Binding the two

• Attest the app and its hardware key once, at enrolment.
• Compute the location verdict on the device, from a statistical proof built on many signals that are hard to fake together.
• Sign the verdict with the attested key, bound to a challenge and a time, so it cannot be replayed.
• Let the relying party verify the signature and the attestation chain without calling anyone. Octet’s octet-verify does this offline.

Last reviewed 19 October 2026