Android is open source, but your phone probably isn't

Android, the operating system itself, is open source — Google publishes the code publicly and lets manufacturers modify it. But the Android phone in your pocket is not. Your device runs Android plus Google's proprietary apps (Gmail, Play Store, Maps), carrier software you can't remove, and manufacturer customizations locked behind permissions you don't control. The open source part is real; the freedom it gives you is much smaller than the name suggests.

When people say "Android is open source," they mean Google releases the source code for the Android operating system under the Apache 2.0 license. Anyone can read it, modify it, and redistribute their version. Samsung, OnePlus, and other manufacturers do exactly that — they take Android, add their own interface and features, and ship it on their phones. That part is genuinely open.

What's not open is everything else on your phone. Google's Play Services, the app store, Gmail, and most of the apps that come preloaded are proprietary. Your carrier adds locked software you cannot uninstall. The bootloader — the code that starts your phone — is usually locked, which means you cannot install a different version of Android even if you wanted to. The hardware drivers are proprietary. The result is a phone that runs open source software on top of a closed ecosystem.

Key Takeaways

  • Android's source code is publicly available and manufacturers can modify it, but the apps and services Google adds on top are proprietary and closed.
  • Your phone's bootloader is usually locked, preventing you from installing custom versions of Android even though the code is open source.
  • Carrier bloatware and manufacturer apps cannot be removed, despite running on an open source foundation.
  • Open source Android does not mean you own or control your device — Google and your manufacturer still control what software runs and what you can change.

What "open source" actually means for Android

Open source means the source code is public and you can read it. For Android, that code lives in the Android Open Source Project (AOSP), hosted by Google. Developers, security researchers, and manufacturers can examine every line, find bugs, and suggest improvements. This transparency is real and valuable — it means thousands of people outside Google can audit the code for security problems.

But open source does not mean free to use however you want. Android uses the Apache 2.0 license, which lets manufacturers take the code, modify it, and sell phones with their version. It does not require them to share those modifications back with Google or with you. Samsung's version of Android, called One UI, is based on open source Android but Samsung's additions are proprietary. You cannot download Samsung's modifications and use them on a OnePlus phone.

Open source also does not mean you can modify your own copy. Even though the code is public, your phone's bootloader is locked. The bootloader is the first code that runs when you turn on your phone — it loads Android itself. A locked bootloader means only code signed by the manufacturer will run. You cannot install a custom version of Android, even one based on the open source code, without unlocking the bootloader first. Most phones make this difficult or impossible without losing warranty coverage.

Why manufacturers lock down open source Android

Manufacturers lock bootloaders for security and business reasons. From a security standpoint, a locked bootloader prevents malware from replacing core system code before Android even starts. If someone steals your phone, they cannot install spyware at the bootloader level where it would be nearly impossible to remove.

The business reason is control. Manufacturers want to ensure their version of Android runs on their phones, not a competitor's or a custom build. They also want to prevent you from removing carrier software or manufacturer apps. If your bootloader is locked, you cannot strip out bloatware or install a cleaner version of Android. Carriers pay manufacturers to include their apps, and locked bootloaders may provide those apps stay installed.

Google benefits too. Even though Android is open source, Google's proprietary services — Play Services, the Play Store, Gmail — are not. Manufacturers who want access to these services must agree to Google's terms, which include keeping certain Google apps on the phone and not modifying them. A locked bootloader helps enforce that agreement.

The difference between AOSP and what ships on your phone

AOSP (Android Open Source Project) is the pure, unmodified Android code. It includes the core operating system, the settings app, the dialer, basic messaging, and the launcher. If you could somehow install pure AOSP on your phone, you would have a minimal Android experience with no Google apps, no carrier software, and no manufacturer customizations.

No phone ships with pure AOSP. Every manufacturer adds their own layer on top. Samsung adds One UI, which changes the look, adds Samsung apps, and integrates Samsung services. Google Pixel phones add Google's own customizations and Google Play Services. Carriers add their own apps for billing, voicemail, and network management. The result is that your phone runs AOSP plus dozens of proprietary additions.

Some of those additions are useful — Samsung's features, Google's integration with your account, carrier services you might need. Others are bloatware you cannot remove. The point is that "Android is open source" does not describe what actually runs on your phone. Your phone runs open source Android plus a closed ecosystem of proprietary software.

Can you install a custom version of Android?

Technically yes, but practically no for most people. Custom Android versions like LineageOS exist and are based on AOSP. They strip out Google services, manufacturer bloatware, and carrier apps, giving you a cleaner, more private version of Android. Some people install them on older phones or phones from manufacturers that support it.

The barrier is the locked bootloader. To install a custom version, you usually have to unlock it first. Some manufacturers allow this — Google Pixel phones can be unlocked, and some OnePlus models can too. Others make it very difficult or impossible. Even when unlocking is possible, it often voids your warranty and may disable features like mobile payments or banking apps that require a locked bootloader for security.

For the vast majority of phone users, custom Android is not a realistic option. It requires technical knowledge, voids your warranty, and may break features you rely on. The open source nature of Android does not change this — your phone is still locked down by the manufacturer, regardless of whether the underlying code is public.

How open source Android affects security and privacy

The open source nature of Android is genuinely good for security. Thousands of developers, security researchers, and companies can examine the code and report bugs. Google patches vulnerabilities faster because researchers can find them. This transparency is one reason Android is reasonably secure despite being open source.

But open source does not mean private. Google's proprietary services — Play Services, the Play Store, Gmail, Maps — collect data about you. Your manufacturer collects data. Your carrier collects data. The fact that Android's core code is open source does not prevent any of that. In fact, most of the data collection happens in the proprietary layers on top of AOSP, which you cannot see or modify.

If privacy is your concern, open source Android is not the solution. You would need to install a custom version without Google services, which requires unlocking your bootloader and losing warranty coverage. Most people cannot or will not do that. For typical users, the privacy implications of Android depend more on Google's and your manufacturer's policies than on whether the code is open source.

What manufacturers actually do with open source Android

Manufacturers use AOSP as a foundation and build on top of it. Samsung takes AOSP, adds One UI (their custom interface), Samsung apps, Samsung account integration, and Samsung services. They keep the core Android code updated with Google's security patches, but they add their own features and their own delays in releasing updates.

Google, which makes both Android and Pixel phones, takes AOSP and adds Google Play Services, Google apps, and Google's own customizations. Pixel phones get updates faster than other phones because Google controls both the hardware and software.

Smaller manufacturers sometimes use AOSP more directly, with fewer additions. But even they add their own launcher, their own apps, and their own branding. The point is that open source Android is a starting point, not the final product. What you get depends entirely on what the manufacturer adds.

Frequently Asked Questions

Can I see the Android source code myself?

Yes. Google publishes the AOSP code on the Android Open Source Project website. You can read it, download it, and examine it. You do not need permission or a developer account. This transparency is real and is one genuine benefit of Android being open source.

Does open source Android mean I own my phone?

No. You own the device, but the manufacturer and Google control the software. A locked bootloader prevents you from installing different software, even though the code is public. Open source does not grant you the right to modify or replace the software on your device.

Why does Google open source Android if they make money from it?

Google makes money from services and advertising, not from licensing Android. By open sourcing Android, Google encourages manufacturers to use it, which gets more people using Google services like Search, Gmail, and Maps. The open source strategy is a business decision, not a gift.

Is LineageOS or another custom Android really more private?

Custom versions remove Google services and manufacturer bloatware, which does reduce data collection. But installing one requires unlocking your bootloader, which voids your warranty and may break banking apps or mobile payments. For most people, the practical cost outweighs the privacy benefit.

Will my phone ever ship with pure AOSP?

No. Manufacturers add their own software to differentiate their phones and to meet carrier requirements. Even Google's Pixel phones, which are closest to AOSP, include Google's own customizations and Google Play Services. Pure AOSP exists only as a reference implementation, not as a shipping product.