Google is revising its Android developer verification program following strong pushback from privacy advocates and open-source communities that warned the original plan could effectively end meaningful sideloading on certified Android devices. The company has confirmed that while identity verification for developers is still moving ahead, it will introduce additional account types and an advanced installation flow so that experienced users can continue to install apps from unverified developers.
The developer verification initiative, first announced in August 2025, is designed to tie Android app distribution to verified developer identities, including legal names and contact details and, in some cases, government-issued identification. Google argues that this change is necessary to raise the cost of malicious app distribution and to stop the whack-a-mole pattern in which banned developers immediately reappear under new accounts.
However, open-source repositories and groups such as the Keep Android Open campaign and F-Droid raised concerns that strict verification for every developer, including those who only distribute APKs outside the Play Store, would undermine pseudonymous development and limit the ability of users to choose the software they run. In response, Google is now planning an advanced flow for what it describes as experienced users, who will be able to sideload software from unverified developers after navigating explicit risk warnings and additional safeguards intended to detect scams or coercion.
Google is also introducing a new account category for students and hobbyists that does not require full identity verification but limits the number of devices on which their apps can be installed. This is intended to preserve a low-friction path for learning and experimentation without granting broad distribution rights to unverified publishers.
The rollout will be phased over several years. Early access to verification has begun for a subset of developers, with broader access scheduled for March 2026. From September 2026, the requirement that any app installed on a certified Android device be registered by a verified developer will apply in Brazil, Indonesia, Singapore, and Thailand. A global rollout is expected in 2027, with Google indicating that it will continue to refine the program based on developer and user feedback.
For enterprises and security leaders, the updated approach has two notable implications. First, the move toward verified identities should, over time, provide better accountability for developers across both Play Store and sideloaded distribution channels, which may reduce the volume of low-cost, high-churn malware campaigns. Second, the preservation of an expert user path for unverified software means that high-assurance environments will still need to enforce their own policies on sideloading and alternative app stores rather than assuming the platform will block unverified apps entirely. Organizations that rely on internally distributed Android applications, including those delivered outside the Play Store, will also need to ensure that their development teams understand and comply with the new verification requirements in each jurisdiction where devices are deployed.
Sources: Android Developers Blog, Google Developer Verification, BleepingComputer
—
By the ID Tech Editorial Team
