Android Developer Verification: New Sideloading Rules Explained

Since 30 September 2026, some Android phones refuse to install an app unless Google knows who made it. Android developer verification is now enforced in Brazil, Indonesia, Singapore and Thailand, and Google plans to take it worldwide in 2027. If you’ve hit a new warning, heard about a “24-hour wait” to sideload, or wondered whether F-Droid still works, the short version is: most people won’t notice anything yet, ADB still works, and the wait exists to stop a specific kind of scam.

The details matter, though, especially if you live in one of those four countries or publish apps there.

How verification works

Every Android app’s package name gets tied to a developer who has registered with Google. When a certified Android device installs or updates an app, a system service checks whether it comes from a registered developer. If it doesn’t, the install is blocked unless you take a deliberate extra step.

According to Google’s Android Developers Blog (18 June 2026), that system service began rolling out to most Android devices in June. Registration opened to developers earlier in the year, and about 99% of Google Play apps were registered automatically. Developers who distribute only outside Google Play register through the new Android Developer Console.

“Certified” means a phone or tablet that ships with Google’s apps and services. That covers almost every Samsung, Xiaomi, Motorola, OPPO, vivo, HONOR and Pixel phone sold outside China. You can confirm yours with our steps for checking if a phone is Play Protect certified.

Phase one: four countries, seven stores

The first phase is deliberately narrow. From 30 September 2026, verification applies to apps installed or updated from seven participating stores on certified devices used in four countries:

According to reporting by TechAIWire and Gadget Hacks, these are not covered yet:

• Direct APK installs. Downloading an APK file and opening it isn’t part of phase one.
• F-Droid and any other store outside the seven, because they aren’t participating stores.
• ADB installs. Google says unregistered apps can still go on with Android Debug Bridge.
• Everyone outside the four countries, including the US, UK, Nigeria and the Middle East, for now.

Installing an unverified app: the advanced flow

For people who really do want an app from an unregistered developer, Google built the advanced flow, which started rolling out in August 2026. Android Authority describes the steps like this:

1. Open Developer options and select Apps from unverified developers.
2. Turn on the option to allow apps from unverified developers.
3. Authenticate with your screen lock.
4. Confirm that nobody is pressuring you to change the setting.
5. Restart the phone and wait 24 hours.
6. Go back to the setting and choose to allow unverified apps for seven days or indefinitely.

Developer options can be switched off again afterwards. If you turn the flow off temporarily, you have a 10-minute grace period to turn it back on without another wait. The same setting controls updates: with it off, updates to apps from unregistered developers fail.

Why make you wait a whole day?

It’s aimed at coercion scams. The usual script goes like this. Someone claiming to be from your bank, a courier or a government agency calls and stays on the line, walking you through installing a “security” or “refund” app. It’s actually remote-access malware, and the whole thing depends on urgency.

A restart and a 24-hour wait break that. You get time to hang up, think and talk to someone. Our page on signs your phone is hacked explains what those apps do once they’re in.

ADB still works, with no wait

Google states that unregistered apps can be sideloaded with ADB, and reports say ADB installs skip both the verification check and the 24-hour wait. ADB needs a computer, USB debugging switched on, and an explicit authorisation prompt on the phone. That’s why Google treats it as a developer route rather than a scam risk.

adb devices
adb install app.apk

The ADB commands guide has more, including how to read a phone’s model and patch level from a computer.

F-Droid, open-source apps and 2027

F-Droid isn’t one of the seven stores, so in phase one its installs aren’t blocked, even in the four countries. 2027 is the real question. Google says it plans to expand verification to all apps on certified Android devices globally next year, after gathering feedback from partners, users and developers. It hasn’t published a date. According to Android Authority and Gadget Hacks, that global phase is expected to cover every installation type, direct APK installs included. Apps from developers who haven’t registered, which is common in open source, would then need the advanced flow or ADB on certified devices.

Google has added a limited distribution account for students, hobbyists and learners. It’s free, needs no government ID and lets a developer share an app with up to 20 devices. A full account, reported to cost a one-off $25 and require government-issued ID, is needed for general release. Whether open-source developers will register, and how stores like F-Droid adapt, is still being argued about.

Will any of this stop scam apps altogether? No system does. Registration makes it harder to publish anonymously and easier for Google to act against a developer, and the 24-hour pause slows coercion scams. Scammers can still try to register, work a patient victim through the advanced flow, or target devices that aren’t certified. Play Protect, updates and plain caution still matter.

If you publish Android apps

Ship apps used in Brazil, Indonesia, Singapore or Thailand through any of the seven stores? Registration is already required.

• On Google Play: check verification status on Play Console Home and register any app that wasn’t registered automatically. Google warned that Play apps still unregistered by 30 September 2026 may be removed from Google Play globally.
• Outside Google Play: sign up for the Android Developer Console and register your package names and signing keys.
• Students and hobbyists: a limited distribution account covers test builds for up to 20 devices.

Google is also launching APIs that let third-party stores check whether a package name is registered, and register apps for a developer.

Buying a used or imported Android phone

Verification only protects certified devices. Phones without Google certification (some grey imports, devices with modified software, counterfeits) miss out on it, and they tend to carry other risks too. Before you buy:

1. Open Play Store › Settings › About › Play Protect certification and make sure it says “Device is certified”.
2. Confirm the real brand and model with a manufacturer and model check. Counterfeits often claim to be a better model.
3. Run a GSMA blacklist check on the IMEI to rule out lost or stolen devices.

The first all-in-one check is free: