Home › Guides › Start here

Android developer verification: what changes for sideloading

Checked against the makers' own pages · Last reviewed October 15, 2026

What Android developer verification is

Google describes developer verification as linking "real-world entities (individuals and organizations) with their Android applications." In practice, an app developer proves their identity to Google, then registers each app's package name (its unique ID, like org.example.app) together with the key the app is signed with.

On a certified Android device, a Google system service called Android Developer Verifier (package com.google.android.verifier) checks whether an app you try to install is registered to a verified developer. If it is not, Google's help page says "you'll get a notification and you won't be able to install the app," unless you have completed the advanced flow described below.

Google's stated reason is fighting malware and scams: it says verification makes it "much harder for malicious actors to quickly distribute another harmful app after we take the first one down." Google also says it found "over 90 times more malware from sideloaded sources than on Google Play." [1][2][7][8]

Timeline: what has happened and what is next

Google's plans changed over 2026. Its March 30, 2026 blog post said that from Sept. 30, 2026, apps "must be registered by verified developers in order to be installed and updated on certified Android devices" in the four countries. A note added to that post on Sept. 29, 2026 says the rollout details were updated: protections begin "to participating stores in select regions on certified Android devices," with global expansion in 2027. Check Google's developer verification page for the current schedule. [1][5][6][8][9]

Which app stores are checked first

For the first phase, Google says it verifies app installs from seven stores:

• Google Play
• HONOR App Market (Honor)
• OPPO App Market (OPlus)
• Galaxy Store (Samsung)
• Palm Store (Transsion)
• V-Appstore (vivo)
• GetApps (Xiaomi)

Google's FAQ (updated July 15, 2026) says that if you install an app from another store, or sideload it directly, "these new verification requirements won't apply to your app yet." Google says it will expand verification to all third-party app stores and, in 2027, to all apps on certified devices.

Google's own pages are not fully consistent. Its limited-distribution guide says that any package names "not registered by this date will no longer be installable on certified Android devices in those regions," without mentioning the store limit. The FAQ and the main guide describe the store-by-store scope. [1][2][7][9]

Which phones it applies to

The requirement applies to certified Android devices. Google's certification page says these are devices that ship Google's apps and that Google tests "to ensure they are secure and ready to run apps from Google and the Play Store"; they include Google Play Protect.

Google's Android Help page adds: "Requirements apply only to Certified Android devices. Android Open Source Project (AOSP) and non-certified devices are exempt from this requirement." The same page says it does not apply in regions where Google Mobile Services (GMS, Google's bundle of apps and services) are unsupported or that are subject to trade sanctions.

Google gives two different minimum Android versions. The Android Help page says it "applies to certified Android devices running Android 8 and up." The developer FAQ says it applies to "all certified Android devices running Android 7 or higher" and that the updates "are delivered through Google Play services," and the timeline on Google's developer verification page also says Android 7+.

Google's FAQ also says verification checks "won't run on certified Android devices physically located in comprehensively sanctioned countries." [2][6][7][10]

Phones without Google: GrapheneOS, /e/OS and others

Google's exemption covers AOSP and non-certified devices. The GrapheneOS project and /e/OS support staff have said developer verification does not affect their systems:

- GrapheneOS: On Oct. 8, 2026, the GrapheneOS project's account wrote on its forum that developer verification "has no impact on either GrapheneOS or sandboxed Google Play on GrapheneOS." - /e/OS: An /e/OS support team member wrote on the /e/OS community forum in February 2026: "De-googled phones aren't affected. As of now it does not impact /e/OS or the apps on it," adding that future Google changes are not known.

For phones sold with these systems, see de-Googled phones and GrapheneOS phones. [2][4][11][12]

The advanced flow: installing apps from unverified developers

Google calls its sideloading path the advanced flow. It is a one-time setup on the phone. Per Google's Android Help page and developer FAQ:

1. Turn on Developer options in Settings.
2. In Settings > System > Developer options, turn on Allow apps from unverified developers.
3. Confirm that no one is coaching you to do this (Google says scammers often pressure victims on the phone).
4. Restart the phone and sign in again.
5. Wait out a one-time 24-hour security delay, then confirm with your fingerprint, face unlock or PIN.
6. Choose to keep the setting on for seven days or indefinitely.

After that, you still see a warning for each unverified app and tap Install anyway. Google says you do not need to keep Developer options turned on afterward, which matters because some banking apps refuse to run while it is on.

Two limits from Google's FAQ: unregistered apps "can only be installed or updated when the advanced flow is enabled or by using ADB," so if you turn the advanced flow off, updates to those apps fail; and there is no ADB command to skip the 24-hour wait.

ADB (Android Debug Bridge, a developer tool that installs apps from a computer over USB) is not affected. Google says "there are no changes to how ADB works" and the waiting period does not apply to ADB installs. [3][7][13]

What developers have to do

Google offers three paths, per its developer guide:

A full-distribution account in the Android Developer Console costs a $25 fee, according to Google's FAQ. Limited-distribution accounts are free and need no government ID, but Google says you still need a Google Account with 2-Step Verification and a Google payments profile with your legal name and address. Organizations also need a D-U-N-S number.

Google says Play Console developers' apps are mostly registered automatically ("99% of apps").

For open-source stores that re-sign apps with their own key (as F-Droid does for most apps), Google's open-source guide explains how a developer can register the store's signing key too. It also says that registering is optional for open-source platforms, but without it, users must use the advanced flow. [1][6][7][9][14]

What it means for F-Droid

F-Droid is an app store for free and open-source Android apps. It opposes developer verification. In a Feb. 24, 2026 post, F-Droid said it "unequivocally" advises developers against signing up "now or ever," and joined an open letter against the program at keepandroidopen.org.

In a July 1, 2026 post, F-Droid wrote that it did "not yet know the exact failure mode to expect" on Sept. 30, and listed open questions for users in the four countries, such as what happens to apps already installed from F-Droid.

Google's position is that you "can continue to use any alternative app store," and that apps from unverified developers can be installed after the advanced flow. On phones that are not Google-certified, Google says the requirement does not apply at all. [2][7][12][15]

Questions people ask