Android now checks who made an app before it installs

6 min read

A new step before an app lands on your phone

Most people get their apps from the Google Play Store and never give it a second thought. Some also install apps from other places: another company's app store, a business website, or a file a friend sends over. Installing an app from outside the official store is usually called "sideloading."

On September 30, 2026, Google began changing how that works. In four countries, Android phones now check whether the person or company behind an app has registered with Google before the app can install the normal way. The rest of the world is scheduled to follow in 2027.

What happened

Google first announced the plan in August 2025, according to The Hacker News. It calls the program developer verification. Under it, developers who share apps outside Google Play must register with Google. The rollout came in stages:

• March 2026: registration opened to all developers.
• June 2026: Google began pushing a new system service, the Android Developer Verifier, to phones running Android 8 or newer. Android Authority noted that it would not affect installs yet.
• July 2026: new developer tools arrived, including a service for checking a developer's registration status.
• August 2026: a free "limited distribution" account and a new "advanced flow" for installing unregistered apps launched worldwide.
• September 30, 2026: enforcement began on certified Android devices in Brazil, Indonesia, Singapore and Thailand.
• 2027: Google says the checks will expand to certified devices globally.

A certified device is one that ships with Google's services and its built-in malware scanner, Play Protect. F-Droid, a free store for open-source apps, estimates that certified devices make up more than 95% of Android devices outside China, The Hacker News reported.

In this first phase, Google's developer guide says installs are checked when they come from Google Play or from the app stores run by Samsung, Xiaomi, OPPO, vivo, Honor and Transsion. In the four countries, an app from an unregistered developer no longer installs through the usual path.

What a developer has to do depends on how they share their apps. Google's guide says those who publish on Google Play are registered automatically. Those who distribute anywhere else must sign up and prove who they are. The Hacker News reported that this means a legal name, address and contact details, possibly a government ID, and proof of ownership for each app. It reported a one-time fee of $25 for a full account. Students and hobbyists can use the free limited account instead, which needs no ID and lets them share an app with up to 20 devices.

Google says the program has caught on. According to Android Authority, Google reported that millions of apps had been registered since March, covering nearly all installs from Play and a large majority of installs from outside it.

Unregistered apps are not banned. People can still install them with ADB, a developer tool that loads apps onto a phone from a computer. Google's guide says that process stays the same. They can also use the new advanced flow. The Hacker News described its steps: turn on developer mode, restart the phone, wait 24 hours, then confirm their identity again.

Google's stated reason is scams. The Hacker News reported Google's view that apps from outside Play carry far more malware, and that scammers more and more often pressure people into installing a harmful app right away. Google said it chose the four countries because app scams are a serious problem there, and the same offenders often strike again. Its developer guide says verification makes it "harder for them to repeatedly spread harm."

Not everyone agrees. F-Droid says the rule would end its project, because many of the volunteers whose apps it builds use pseudonyms and will not give Google a legal identity. A campaign called Keep Android Open, backed by more than 70 organizations in 23 countries, is asking Google to drop ID checks for apps shared outside Play. The Hacker News also listed questions Google had not yet answered, including how a developer flagged by mistake could appeal and what the identity registry keeps, and for how long.

How this kind of thing happens

Every Android app is digitally signed with a private key, a secret code that only the developer should hold. The signature proves the app hasn't been altered since the developer signed it. Until now, it said nothing about who that developer really was. Anyone could create a key under any name.

Scammers rely on that gap. The FTC warns that scam messages often pretend to come from a company you know and trust, such as your bank, and tell a story to get you to act. Google says a growing number of these scams end with the victim being talked into installing a harmful app on the spot. Google also says the same offenders often return after being caught.

Google's change goes after both halves of that scheme. Registration ties an app's signing key to a developer who has registered with Google; Google argues this makes it harder for bad actors to keep coming back. The 24-hour wait in the advanced flow is aimed at the pressure itself. Google's guide says the wait gives people time and space to break away from someone who may be coercing them.

Why it matters at home

Most people may not notice a change. According to The Hacker News, apps from registered developers keep installing as before, and Google says registered apps already cover nearly all Play installs. In the United States, enforcement is not due until the global rollout in 2027.

Where it could touch you: a small or older app, perhaps from a volunteer open-source project, might stop installing the usual way if its maker doesn't register. That is the cost critics such as F-Droid are pointing to.

The more useful lesson for families has nothing to do with country or timing. If anyone, on a call or in a message, tells you to install an app right now, slow down. Google built a full day of waiting into its system for exactly that reason.

What you can do

• Get apps from your phone's official app store whenever you can. Under the new rules, those apps come from registered developers.
• Before you install, look at the developer name on the app's store page and make sure it matches the company you expect.
• Never install an app because a caller, text or pop-up tells you to, even if it claims to be your bank. The FTC advises contacting the company through a phone number or website you know is real.
• Never turn on developer mode because someone else told you to. It exists for app makers, and a stranger asking for it is a warning sign.
• Turn on automatic software updates for your phone, as the FTC recommends, so the newest protections reach you.
• Report scam attempts to the FTC at ReportFraud.ftc.gov, and forward scam texts to 7726 (SPAM).
• Talk with older relatives and teenagers about this pattern. A scam is easier to spot when you have heard it described before.

Sources

1. Google, Android developer verification guide
2. Android Authority, Jun 19, 2026
3. The Hacker News, Jun 22, 2026
4. FTC, How to recognize and avoid phishing scams

This article is based on the published reports listed above, written in our own words. Details are as reported on the dates shown. Spotted an error? Email support@krudodesigns.net and we will correct it.