Android to Ban Installation of Apps from Unverified Developers
Google has announced a major policy shift: beginning in 2026, only applications from verified developers will be installable on certified Android devices. The move is aimed at curbing malware distribution and financial fraud, and it will apply to apps installed from third-party sources as well as through sideloading.
Scope of the Rule
The requirement will cover all certified Android devices—those running Play Protect and shipping with Google apps pre-installed.
Google first introduced developer verification in the Play Store in 2023, which the company says significantly reduced both malware and fraud. The new policy expands that requirement to all apps, including those distributed through third-party stores or sideloaded via APK files.
The company likened the process to an airport check:
“Think of it like an airport document check—it verifies a traveler’s identity but is separate from screening their luggage. We will be verifying the developer’s identity, but not reviewing the content of their app or its provenance,” Google explained.
The change is designed to combat “convincing fake apps” and hinder malicious actors who quickly release new malware after previous versions are taken down.
Why the Change Matters
Google cites internal research showing that apps from third-party sources are 50 times more likely to contain malware compared to apps available in the Play Store.
At the same time, the company stressed that developer freedom will not be curtailed:
“Developers will retain the same freedom to distribute their apps directly to users through third-party sources or use any app store they prefer.”
How Verification Will Work
To support this initiative, Google will launch a simplified Android Developer Console for developers who distribute apps outside the Play Store. The process will include:
- Identity verification of developers.
- Registration of package names and signing keys for apps.
Those already publishing apps via the Play Store likely meet these requirements through the existing Play Console, which requires organizations to provide a D-U-N-S number (Data Universal Numbering System—a unique nine-digit ID for legal entities).
Timeline for Rollout
- October 2025 – testing of the verification system begins with select developers.
- March 2026 – developer verification opens to all.
- September 2026 – enforcement begins in Brazil, Indonesia, Singapore, and Thailand, countries Google says are especially affected by fraudulent apps.
- 2027 – requirement expands worldwide.
