Update (October 1, 2026): These rules are now in effect. For a plain-English guide to what is enforced today, who is affected and how the new advanced flow works step by step, read Android’s New App Install Rules Are Live: What Changes for You.
Android developer verification stops being a future policy on September 30, 2026. That is the date Google has set on its own developer verification page as the first enforcement deadline. It does not apply everywhere. Enforcement begins for users in Brazil, Indonesia, Singapore and Thailand, on certified devices running Android 7 or newer.
The deadline is 24 days away at the time of writing, and it is the first hard date in a rollout Google has been staging since March 2026. Everything before this was opt-in: developers could register, but nothing broke if they did not.
What changes on September 30
Google’s page lists exactly which app stores are covered in the first wave. They are Google Play, HONOR App Market, OPPO App Market, Galaxy Store, Palm Store, V-Appstore and GetApps. From that date, apps installed through those stores in the four launch countries need a registered, identity-verified developer behind them.
Most of that happens invisibly. Google’s page says Play “automatically registers 99% of apps,” so the practical weight of this deadline falls on apps distributed outside Play rather than on someone installing from the Play Store in São Paulo or Jakarta.
Apps from developers who have not registered do not simply vanish. They move behind what Google calls the advanced flow — a deliberately slow install path with a mandatory 24-hour wait built into it. We covered how that advanced flow works when it reached phones in August. The other route is ADB from a computer, which is not something most people will do.
Google’s stated reasoning is on its own verification FAQ, updated May 11, 2026. It argues that takedowns alone do not work because anonymous developers can simply re-register: “Identity verification helps disrupt this cycle by requiring a real accountable identity behind the software.”
Who is not affected yet
Readers in the US, India, the EU and everywhere else outside those four countries see no change on September 30. Google’s own timeline puts the global expansion at “2027 and beyond,” covering all apps on all certified Android devices. No month has been named for that.
That 2027 line is the part worth watching. The four-country phase is small enough to be a controlled test. The global phase is the one that changes what installing an APK on your own phone looks like, and Google has not committed to a date for it.
The cost buried under the safety framing
The anti-scam case here is real. Malware campaigns do lean on social engineering, and a developer who has handed over a government ID is harder to replace after a ban. That is a genuine benefit, and it is worth saying plainly.
But the mechanism is a barrier, and barriers do not sort neatly into good and bad actors. Standard verification requires a government-issued ID. A hobbyist shipping a free utility on GitHub will face the same identity check as a company. Google has softened this with a limited-distribution account for students and hobbyists, which its own sign-up guide describes as having “fewer verification requirements and no fee” and which allows sharing with up to 20 devices. Twenty devices is a testing allowance, not a distribution channel.
The honest summary is that Android is trading some of its openness for a harder floor against malware. Google is not hiding the trade, but its framing leads with the safety half. Sideloading survives. It just gets slower, more deliberate, and gated on someone else’s registration status.
What to do now
If you develop apps and distribute outside Play, register through the Android Developer Console before the deadline if you have users in the four launch countries. If you sideload apps, check whether the developers you rely on have said anything about registering. The apps that break first will be the small, single-maintainer ones.
