Google will require developer verification to install Android apps, including sideloading

vdbhb59 · November 12, 2025, 6:14am

gist.github.com

https://gist.github.com/agnostic-apollo/b8d8daa24cbdd216687a6bef53d417a6

android-developer-verification-discourse.md

# Android Developer Verification Discourse

On August 25, 2025 Google [published a blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html) that starting in 2026, Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices. This applies to all apps installed from outside the Google PlayStore from either third part app stores like F-Droid, or directly from sites via browsers/file manager apps. Publishing apps on Google PlayStore already has had these same requirements since July 12, 2023. The verification requirements for all apps will engage for Brazil, Indonesia, Singapore and Thailand in September 2026 and engage globally in 2027 and beyond.

There has been lot of noise and backlash regarding the new requirements since then. Malware being deployed both outside and from PlayStore is a big issue and is obviously a cause for concern and a legitimate reason for how developer verification can help reduce it, but not finish it.

I have been thinking over this the past few months and have had a lot of random thoughts regarding this. I finally decided to write a post on this to provide a detailed overview for why and how will these changes will be implemented and the huge amounts issues they will cause. I didn't have time for all this, but there hasn't been positive progress regarding this so I was forced to take time out at expense of other work. I have also been researching into how developer verification will work internally at the Android framework level and have posted the details in the [Internal Implementation](#internal-implementation) section.

I am not against the developer verification requirements as malware is obviously out of control, but I am very against Google not providing a non-adb opt-out for users to be able to install apps from unverified developers including open source apps on the devices they own. A huge amount of issues related to package names and signing keys and even legal issues also exist, and that makes the current design not being viable for everyone. **In addition to this post I have opened the Android Developer Verification Proposed Changes issue on Google's issuestracker at https://issuetracker.google.com/459832198 with a proposal on how a possible opt out can be implemented.**

This file has been truncated. show original

Also: Google Issue Tracker