Google Mandates Developer Verification: Sideloading Restrictions Begin in 2026
Google is enforcing mandatory developer identity verification for APK sideloading, starting September 30, 2026, in Brazil, Indonesia, Singapore, and Thailand. The requirement will expand to all certified Android devices globally by 2027. The move marks the biggest shift in Android's nearly two-decade history of open sideloading, and could significantly narrow the APK distribution channels that crypto wallets and privacy tools have long relied on.
In an August 2025 blog post, Google said it is adding a new security layer for "certified Android devices." All developers must register an account and pass real identity verification before their apps can be installed on these devices, whether through sideloading, third-party app stores like F-Droid, or direct APK installation. Google noted that malware from sideloading sources is more than 50 times more prevalent than apps distributed through Google Play. Additionally, the GodFather Android malware, which targeted over 200 crypto wallets by stealing 2FA codes, has been cited as an example of sideloading risks.
According to the official timeline, developer APIs, limited accounts, and advanced flows were introduced in August 2026. Starting September 30, 2026, the four pilot countries will enforce the rule on Google Play, Galaxy Store, OPPO App Market, HONOR App Market, and other participating stores, as well as certified devices running Android 7 or later. The policy will go global in 2027.
Google Play has already automatically registered 99% of apps. Developers who do not publish on the Play Store must verify through the Android Developer Console. Google has packaged the 99% coverage, limited accounts (students, teachers, and hobbyist developers can share up to 20 devices without government ID or registration fees), and advanced flows (allowing advanced users to install unverified apps) as a balance between openness, choice, and security.
Security or Control?
The community has pushed back strongly. Tuta and the Electronic Frontier Foundation (EFF) criticized the move as "Apple-fying" Android, arguing that the real goal is control and profit. "The more apps are distributed through Google Play, the more Google takes a cut," Tuta wrote in its blog. Google compared the change to checking IDs at an airport, but Tuta countered: "Is it for security, or for Google to know the identity of every developer?"
EFF and Brave also expressed concerns, saying the verification threshold would disproportionately harm small developers, privacy tools, and apps that challenge Google's own interests.
Official Stores Are Not Immune
Notably, Google Play itself is not entirely safe. The official store has hosted fake Ledger Live wallets that tricked users into entering seed phrases and draining funds. Similarly, the Apple App Store has seen fake Ledger wallets that led to 50 victims losing $9.5 million, prompting security researcher ZachXBT to call for a class-action lawsuit against Apple. These incidents undermine the argument that only official stores are safe.
26 Days to Go: What Alternatives Exist?
With 26 days until the first enforcement date, Tuta acknowledged that downloading APKs from unknown sites carries risks, but insisted users should have the freedom to assume that risk. Beyond launching a petition, Tuta recommends switching to custom ROMs like LineageOS, CalyxOS, e/OS, or GrapheneOS, or buying phones that do not rely on Google services, such as the Dutch Fairphone or German Volla.
For developers and users still within the Google ecosystem, limited accounts and advanced flows offer a temporary buffer. Hobbyist developers can apply for limited accounts, and advanced users can use the advanced flow to continue installing unverified apps.
However, September 30 is just the first step. When the global mandate arrives in 2027, the sideloading ecosystem that the community has long relied on will need to find alternative paths.