com.android.hotwordenrollment.okgoogle Copy

This is a hotword (keyphrase) enrolment component associated with the Google Assistant. Android privileged-permission configuration grants it the KEYPHRASE_ENROLLMENT_APPLICATION and MANAGE_VOICE_KEYPHRASES permissions, marking it as a privileged keyphrase-enrolment app. It relates to Voice Match, the feature that lets a user activate the Assistant hands-free by saying the hotword ("OK Google" or "Hey Google") instead of pressing a button. Before it works the user sets up Voice Match so the Assistant recognises them when they speak the phrase. Depending on the device it may be signed by Google or re-signed by the handset maker. It is a companion to com.android.hotwordenrollment.xgoogle, another hotword enrolment component with the same privileged permissions. For Android Enterprise, EMM and kiosk fleets, always-listening hotword detection is often unwanted, and "Hey Google" can also simply be turned off in settings. Disabling this enrolment component is expected to remove hotword-based Assistant activation while leaving the Assistant itself in place, so it can still be launched by button or gesture where allowed. This effect is not documented by Google, so confirm it on your specific build before rolling it out at scale.

• Access Google Assistant with your voice (Voice Match, turn 'Hey Google' on or off) - Google Assistant Help →
• privapp-permissions-hotword.xml grants KEYPHRASE_ENROLLMENT_APPLICATION to the hotwordenrollment packages - AOSPA vendor config →
• Package signer provenance for com.android.hotwordenrollment.okgoogle - Android System App Database →

• Re-signed by each device maker with its own platform key - 10 different certificates appear across 4 device makers in our sample. That is the signature of a stock AOSP/system package every OEM builds and signs itself, not a single maker's or a third party's preinstall.
• Its largest observed manifest declares 7 permissions: 1 runtime (user-granted), 2 signature or system-level, 3 install-time and 1 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.