Before a phone from the drawer gets a second job pointed at a door, somebody usually asks whether it is too old. That question tends to get answered by feel: the battery seems fine, the screen has a crack, it felt slow last year. There is a better input than feel for one part of it, and in the UK it has been a legal requirement since spring 2024. The maker has to write down how long the phone will get security updates, and publish it.
I went and read the law, then read two of the documents it produced. One of them ended in February 2025. The other does not contain a calendar date at all. Both are worth seeing before you decide what an old phone should be trusted with.
None of this is legal advice and I am not a lawyer. It is a close reading of a short statutory instrument and two manufacturer statements, aimed at people who are about to repurpose a handset.
What the law asks a phone maker for
The rules come from the Product Security and Telecommunications Infrastructure Act 2022 and a set of regulations made under it in 2023. The government's guidance page puts the start date plainly: "The UK’s consumer connectable product security regime came into effect on 29 April 2024."
The same page lists the three security requirements in a line each:
- "banning universal default and easily guessable passwords"
- "publishing information on how to report security issues"
- "publishing information on minimum security update periods"
Phones are inside the regime. The exclusions on the guidance page are narrow, and the computing one reads "desktop computers, laptop computers and tablet computers which do not have the capability to connect to cellular networks". A handset with a SIM slot is none of those.
The third requirement is the one that matters for a repurposed phone, and the regulations define its key term carefully. A "defined support period" means "the minimum length of time, expressed as a period of time with an end date, for which security updates will be provided".
Three more sentences in the same schedule do most of the work:
- "The defined support period must be published."
- It has to be written "in such a way that is understandable by a reader without prior technical knowledge."
- "The security requirements in this paragraph are not met if the defined support period is shortened after the publication of the information in sub-paragraph (2)."
So the number can go up after publication but not down. The document that carries it is called a statement of compliance, and the regulations say it must include "the defined support period for the product that was correct when the manufacturer first supplied the product;".
That is the promise in the abstract. Here is what it looks like on two real handsets.
Statement one: a date that has already passed
OPPO publishes its UK statements as PDFs. The one for model CPH2371, filed under the Find X5 Lite name, lists "Product Type: Mobile Phone" and then, on the line that matters, "Defined Support Period: 3 years (until 01-February-2025)", followed by an address where any update would be published.
The statement is signed and dated "2024-04-12". I ran the arithmetic: from the signature to the end of the period is 295 days, a little under ten months. From the day the regime started to the end of the period is 278 days.
None of that is a criticism. This is a model that went on sale years before the law existed, and the statement does what the law asks: it names a period and a calendar end date, and says where an extension would appear. What it shows is the situation a repurposing project is usually in. The handsets people hand down are, by construction, the old ones, and an old handset's published support period may be finished before anybody thinks to look. When I read it in November 2026, that end date was 640 days in the past.
Statement two: a period with no calendar date in it
Google publishes its UK statements as help-centre pages, one per Pixel model. The statement for the Pixel 10a gives its UK defined support period as "At least seven years from when the device first became available on the Google Store in the US".
The page is dated "November 7, 2025". The period is generous. What it does not contain is a date you can copy down. To get one you need a second fact, the day the model first went on sale in the United States, which Google points to on a separate page, and then you do the addition yourself.
Whether a relative period like that satisfies "expressed as a period of time with an end date" is for the regulator to decide, not me. The practical point for someone holding the handset is simpler: two manufacturers answered the same legal question in two different shapes, and one of the shapes needs a lookup and a sum before it tells you anything.
The same page also carries a scope note worth reading twice: the statement "is only applicable to products listed above where sold in the UK." Outside the UK, the number is still the best public signal of the maker's intent for that model. It is not a UK-law commitment to you.
What the published date covers, and what it leaves out
Reading the schedule closely, the security update requirement applies to the phone's hardware and to software pre-installed on it at the point of supply, plus software that has to be installed for the product to do what the manufacturer intends. Then there is a carve-out written specifically for phones. The broadest category of covered software is "software used for, or in connection with, any manufacturer’s intended purpose of the product unless the product is a smartphone or a tablet computer capable of connecting to cellular networks."
My reading, which is a reading and nothing firmer: for most connected gadgets, companion software the maker supplies is pulled into scope. For a smartphone, that wider category is switched off, and the commitment stays with the phone itself and what ships on it.
Either way, a camera app you download onto an old phone was not made by the phone's manufacturer and was not installed when the phone was supplied. The phone's support date says nothing about it. If you want to know how long an app will be maintained, that is a separate question for whoever publishes the app.
Three more gaps, stated plainly:
- Handsets sold before the start date. The regulations "come into force on 29th April 2024". A phone sold new before that was not required to arrive with a statement, although, as the OPPO example shows, makers have published statements for older models that were still on sale afterwards.
- Phones bought outside the UK. The Google note above limits the statement to UK sales.
- Second-hand sales. The guidance page frames the regime around people "who purchase new connectable products". I did not find text in the documents I read that settles whether a resold handset carries any obligation, so I am leaving that as an open question.
The password rule, briefly
The first requirement is shorter and less useful to someone repurposing a phone, but it explains a habit worth keeping. The regulations say passwords must be "unique per product; or" "defined by the user of the product.", and passwords that are unique per product cannot be "based on incremental counters;" or "based on or derived from publicly available information;".
That rule binds the hardware maker, and it applies to "hardware of the product when that product is not in the factory default state;". It does not reach a camera app you install afterwards. The habit it encodes travels well anyway: any starting password that came printed in a manual or a setup guide is, by definition, publicly available information. Before a repurposed phone streams anything, the login in front of that stream should be one you chose.
A check that takes about five minutes
- Find the model number on the handset itself. It is usually under Settings, then About phone. Marketing names are often shared across several model numbers, and the statements are filed by model number.
- Search for the maker's UK statement of compliance for that model. The phrase PSTI statement of compliance plus the model number is what both documents above are titled around.
- Read the defined support period. If it is a calendar date, copy it. If it is a period counted from a launch, find the launch date the statement refers to and do the sum.
- Write the date on the phone. A strip of tape on the back is enough. It is the one fact about this handset that will not change by feel, and the person who picks it up in two years will not remember where you found it.
- If the date has passed, narrow the job. A phone past its published support period still powers on and still records. What it no longer has is a public promise of security fixes. That argues for a smaller job: one task, on a network you control, signed in to as little as possible, with nothing on it you would mind losing.
- If you cannot find a statement at all, treat the support period as unknown rather than generous. Unknown is an honest entry. A guess written on the back of the phone is not.
What I could not establish
I could not settle the second-hand question from the documents I read, and I would rather leave a visible gap than fill it with a guess. I also have not checked whether OPPO published an extension for CPH2371 at the address its statement points to. The statement allows for one, and if it exists, the date in this piece is out of date for that model.
What is settled is narrower and more useful. For phones sold new in the UK since April 2024, the end of security support is a published fact with a legal floor under it. For a handset about to start a second career, reading that fact takes less time than charging the battery.
Try it: Background Camera RemoteStream on Google Play records with the screen off and keeps the footage on the phone. Setup notes and other write-ups are at superfunicular.com.
Sources. The PSTI security requirements regulations on legislation.gov.uk, the UK government guidance on consumer connectable product security, OPPO's UK statement of compliance for model CPH2371 and Google's UK statement of compliance for the Pixel 10a. Quotations are verbatim from those pages as fetched on 3 November 2026. The handset cannot tell you when its maker stops looking after it, but in the UK the maker now has to say so in writing.
Top comments (0)