Google Starts Blocking Sideloaded Android Apps From Unverified Devs

If you've installed an app in Brazil, Indonesia, Singapore or Thailand over the past week outside of an official app store, there's a decent chance your phone made you jump through hoops first. Since September 30, Google has started actually enforcing a rule it announced more than a year ago: apps from developers who haven't verified their identity with Google no longer install normally on certified Android devices, even when you're sideloading them yourself.

What actually changed on your phone

"Sideloading" just means installing an app from outside the Play Store — downloading an APK (the installer file Android apps come packaged as) from a website and tapping it open, instead of hitting "install" inside an app store. Until now, that was a one-tap affair as long as you'd allowed installs from unknown sources in your settings.

That's changed for devices running Android 7 or later in the four pilot countries. The block applies across Google Play and six other app stores that signed on, including Samsung's Galaxy Store, Xiaomi's GetApps, Oppo's and Vivo's app stores, Honor's App Market and Transsion's Palm Store. If the app's developer hasn't registered with Google's Android Developer Console — the same signup Play Store developers already go through, with a one-time $25 fee and identity checks — the install gets stopped before it starts.

It isn't an absolute wall. Google built in an escape hatch called the Advanced Flow for people who know what they're doing:

• Turn on developer mode in settings and acknowledge the risk warnings
• Restart the phone and wait a full day before continuing
• Re-authenticate with a fingerprint, face unlock or PIN
• Choose to allow unverified apps for seven days, or indefinitely

Developers who just want to share a hobby project or a test build with friends also get a lighter option: a free "limited distribution" account that skips the government-ID requirement, capped at 20 authorized devices. Apps installed through ADB (Android Debug Bridge, a tool developers use to push software to a phone directly from a computer) are exempt entirely, which is why this is really aimed at casual sideloading, not at developers testing their own builds.

Why open-source developers are furious about it

Google frames this entirely as an anti-scam measure, pointing to internal data that unverified, sideloaded apps carry malware at dramatically higher rates than anything on Play. Brazil's banking federation, quoted in Google's own announcement, called it a step toward "protecting users and encouraging accountability" — unsurprising, given how much phishing and fraud in Brazil runs through fake banking apps pushed via WhatsApp links.

But F-Droid, the open-source app repository that many Android enthusiasts rely on precisely because it isn't Play Store, isn't buying the security framing. Alongside dozens of digital rights groups that organized under the banner "Keep Android Open," it put its objection bluntly:

"We do not believe that developer registration is motivated by security. We believe it is about consolidating power and tightening control over a formerly open ecosystem."

Their worry isn't theoretical. A developer in a country with patchy ID infrastructure, or one who simply doesn't want to hand Google a passport scan to publish a free weekend project, now has a real barrier between them and Android users who'd otherwise have installed their app in ten seconds.

The India angle nobody's talking about yet

Here's the part that should matter more to Code24 readers than it currently does: India isn't in this first batch of countries, despite being Android's single largest market by device count. Google has said the requirement expands globally sometime in 2027, and when it does, it lands on an ecosystem that runs on sideloading in ways Brazil and Indonesia don't quite match — regional banking and government apps that never made it to Play, APKs shared over WhatsApp during connectivity-starved product launches, and an entire secondary economy around apps blocked or delisted from Play for policy reasons.

It also arrives alongside, not instead of, India's own fight over Google Play's dominance. The Competition Commission of India has already fined Google twice over Play Store billing practices, and the government-backed Indus Appstore — built with PhonePe's backing specifically to offer an alternative to Play — exists because Indian regulators and companies already think Google has too much leverage over how apps reach phones here. A global verification mandate, layered on top of that, would hand Google a say over app distribution even on the stores built to get around it, since those stores are among Google's listed launch partners elsewhere. Indian developers building for regional languages or niche use cases that Play's policies don't accommodate well would be smart to watch this rollout closely rather than assume 2027 is far off.

Google insists the overwhelming majority of users won't notice any of this, since verified apps install exactly as before. That's probably true for people who only ever touch the Play Store. It's the long tail — independent developers, open-source projects, and entire app ecosystems built around sideloading out of necessity rather than preference — that will decide, over the next year, whether this policy reads as sensible fraud prevention or as Android quietly closing a door it spent over a decade leaving open.