Google sets September start for Android developer verification
Android will begin blocking unverified sideloaded apps in four countries as Google phases in a new identity-check system for developers.
By Maya Lindqvist · Senior Technology Correspondent
3 min read
Google will begin enforcing Android developer verification on Sept. 30 in Brazil, Indonesia, Singapore and Thailand, according to a company blog post by Matthew Forsythe. The change matters because apps from developers that have not verified their identities will be blocked from sideloading on Google-certified Android devices once enforcement reaches a market.
Google says the first four countries were chosen because they have high levels of app-related scams. The company has argued that identity checks for developers outside Google Play are needed to reduce malware and fraud schemes that persuade users to install harmful apps.
The system extends a Play Store-style identity requirement to developers who distribute Android apps through other channels. Google opened a new developer console in March and has offered outside developers early verification, including a paid option listed at $25, according to Ars Technica.
Google says almost all apps in Google Play are prepared for the requirement, and that a “large majority” of apps distributed outside Google Play have completed verification. Developers that do not register will lose the ability to have their apps installed through sideloading on certified Android devices in countries where the rule is active.
Third-party stores included at launch
Google says it will recognize verification performed through several approved app stores. If a developer is verified through one of those stores, Google says that status will count for Android verification.
- Google Play
- HONOR App Market
- OPPO App Market
- Samsung Galaxy Store
- Transsion Palm Store
- vivo V-Appstore
- Xiaomi GetApps
Google also plans to add tools meant to reduce the work for outside developers. The company says an Android Developer ID Status API will let developers check whether a package name is already registered with Google, while an Android Developer Console API will let them register and manage package names from their own development tools.
Rollout schedule
Google says the first technical step arrives this month, when a new system service called com.google.android.verifier is added to most certified devices running Android 8 or newer. The service will allow Android to block installation of unverified apps, but Google says it will remain inactive until enforcement begins in a user’s region.
In July, Google plans to release the developer APIs and begin testing limited distribution accounts. Those accounts are intended for hobbyists and small-scale app sharing, according to Google, and will not require a fee or government ID verification. Google says apps under those accounts can be installed on as many as 20 devices.
In August, Google says it will make an “advanced flow” available worldwide before the first enforcement date. Ars Technica has reported that this process will let users bypass verification, but only after finding a buried settings path, confirming risk warnings more than once and waiting 24 hours before completing installation.
On Sept. 30, devices in Brazil, Indonesia, Singapore and Thailand will begin checking whether an app’s developer has been verified before allowing installation, according to Google. The company says it plans to expand Android developer verification in 2027 and eventually make it a worldwide policy for certified Android devices.
This story draws on original reporting from Ars Technica.