Google Android tightens PIN attempt limits and expands backup data to count against Drive storage

Google has introduced new security controls in Android 16 that limit the number of PIN entry attempts. The system blocks a device after 20 failed attempts and enforces step‑wise caps—10 attempts in the first minute, 20 in six minutes, 50 in 25 minutes, 110 in 24 hours and 1,800 over five years. Duplicate rapid attempts are excluded from the total, and devices can be remotely unlocked via Google’s Find My Device service.

Starting 7 July 2026, Google will also count all Android backup data toward a user’s Google Drive quota. Backups of apps, SMS messages, call logs, device settings and other app data will be included, replacing the current model that only counts photos, videos and MMS content. Google estimates the average increase in usage to be about 40 MB per account. The change takes effect for new users immediately and will be rolled out to existing accounts over the coming months, with Pixel devices already showing detailed per‑app backup usage in settings. The update is delivered via Google Play Services 26.24.