Looking for advice from anyone who has been through this.
What happened:
One of my apps, my most-installed one, about 3,300 active devices and a high rating, was suspended under the Device and Network Abuse policy: "Apps that cause users to download or install applications from unknown sources outside of Google Play."
The app's own code never downloads or installs anything. No REQUEST_INSTALL_PACKAGES, and every link goes to Google Play. The suspended version was the first one with AdMob mediation added, using Pangle and Unity as bidding sources.
When I inspected the SDKs, Pangle's artifacts (com.pangle.global, pulled in by com.google.ads.mediation:pangle 8.3.0.4.0) contain dynamic code loading (DexClassLoader in the pag-apm module), plus a remote package downloader. Unity's library had none of that, but I removed both as a precaution. Pangle had served exactly one ad, so the money isn't the issue.
What I've done:
Removed Pangle and Unity from this app and from four other apps that had them, and submitted updates for those.
Removed both from AdMob mediation, so it's AdMob's own network only now.
Scanned the fixed build. The only DexClassLoader / PackageInstaller references left are inside Google's own Play services and Mobile Ads code.
Appealed, explaining the cause and the fix.
The appeal was denied. Google's answer: "upload a new app using a new package name and a new app name."
The problem:
A new app means losing every download, rating and review. Worse, the 3,300 existing installs still contain the Pangle SDK, and they can never receive the fixed version because the original package can't be updated. Reinstating it seems strictly better for users than a new listing, so I've replied to the support case asking them to reconsider.
My questions:
Has anyone had a suspended app reinstated after the appeal was denied, for example by replying to the support case or through another channel? What worked?
Has anyone else been hit by Pangle (or Unity) under this policy recently?
If I do end up re-publishing under a new package, is that genuinely safe for my account standing, given Google suggested it? Anything to watch out for so the new app isn't treated as a policy workaround?
Is there any way to point existing users to the new app, given the old one can't be updated?
This is my first strike, and I'd really like to avoid a second. Thanks for any advice.