Google adds 24-hour wait to Android sideloading to curb scams

Google is rolling out an "advanced" sideloading flow for Android users to restrict the installation of apps from unverified developers. The move introduces significant friction into the installation process to protect users from malware and social engineering scams.

The new system targets apps distributed outside the official Google Play Store by developers who have not undergone identity verification. According to the company, the advanced flow is designed to resist coercion by scammers, ensuring users cannot be pressured into installing harmful software in real-time. The most notable hurdle is a mandatory 24-hour waiting period that must elapse before an unverified app can be installed on a device.

A Tiered Verification System

This rollout is part of a broader shift toward a tiered verification ecosystem. Under this model, verified developers who provide identification and pay a fee can continue to distribute apps outside the Play Store normally. For those who do not meet these criteria, the advanced flow serves as the primary gateway. Matthew Forsythe, director of product management for Android app safety, has explicitly described the process as "high friction," noting that Android aims to prove an ecosystem can be both open and secure.

Users seeking to bypass these specific restrictions can still utilize the Android Debug Bridge (ADB), a tool typically used by developers for testing and debugging. However, for the average consumer, the advanced flow creates a deliberate pause intended to discourage the casual installation of potentially malicious software.

Industry Implications

The introduction of the 24-hour wait represents a fundamental change in Android's historically open approach to app distribution. By adding structural barriers to sideloading, Google is tightening its control over the ecosystem to combat the rise of sophisticated mobile threats.

This shift has drawn criticism from open-source advocates, including the team behind F-Droid. Critics argue that because these restrictions are managed via Google Play Services rather than the core Android operating system, Google retains the ability to alter the rules of app installation without explicit user consent or OS-level transparency.

What to Watch

As the advanced flow becomes more common, the industry will be watching how it impacts the viability of independent app stores and hobbyist developers. While Google maintains that the system balances security with openness, the actual impact on user behavior and the prevalence of sideloading-based malware remains to be seen. It is currently unclear how these verification requirements will be phased in globally or which specific markets will be the first to see the full enforcement of developer verification rules.