Sidebar on the CRA, which was mentioned

Posted Oct 6, 2025 12:12 UTC (Mon) by pizza (subscriber, #46)
In reply to: Sidebar on the CRA, which was mentioned by farnz
Parent article: F-Droid and Google's Developer Registration Decree

> For the CRA to kick in, you need to place software on the market, and attempt to make a profit from it, either directly (by attaching it to an income stream that exceeds, or that you expect to exceed, your costs) or indirectly

...In this context, does "monetizing the software via embedded advertisements" count as direct income, indirect income, or not at all?

Sidebar on the CRA, which was mentioned

Posted Oct 6, 2025 12:54 UTC (Mon) by farnz (subscriber, #17727) [Link]

As I understand it, it'd count as income, and therefore if it exceeded your costs, or if you intended it to exceed your costs (noting that your costs include market rate for your labour), then it'd bring you into the CRA's liability regime for security issues.

Note that the only reason the CRA has direct and indirect income at all is to make clear that you can't say things like "I'm not charging for the app - I'm charging for extra storage", or "the app makes a loss; it's the car maintenance services that make a profit" to avoid security liability. Instead, if you're putting the app on the market as an attempt at making a profit, or if you're putting it on the market and actually making a profit, then you're liable for security fixes into the future.

Note, too, that the CRA only requires security fixes to be available at no extra cost; it does not impose other liabilities on suppliers (other liabilities, like fitness for purpose, are pre-existing, and have been around for decades).