Google to restrict Android sideloading with new developer identity mandates

Google is introducing a mandatory developer verification system for Android sideloading that requires creators to submit legal identities to avoid installation blocks. The move signals a significant shift toward a more restrictive security model, moving the open-source ecosystem closer to the closed environment of Apple's iOS.

Starting September 30, 2026, the restrictions will first hit Brazil, Indonesia, Singapore, and Thailand, before rolling out globally in 2027. To be "verified," developers must provide a legal full name, physical address, phone number, and government ID. Full accounts require a $25 registration fee, and organizations must additionally provide a DUNS number. While existing unverified apps will remain functional, these rules apply to all new installations and updates.

The 'Advanced Flow' Barrier

Apps from unverified developers will be blocked from normal installation. Users who still wish to install such software must navigate a high-friction "advanced flow." This process requires enabling developer options, performing a full device restart, and waiting 24 hours before the app can be installed. The process concludes with a mandatory biometric or PIN re-authentication.

Google is delivering these restrictions via Google Play Services, which allows the company to update security policies server-side without requiring a full operating system update. To justify the move, Google claims that malware is 50 times more prevalent from sideloaded sources than from the official Play Store, citing a need to combat social engineering scams.

Implications for Open Source

The new policy creates a significant hurdle for the independent software community. For open-source repositories like F-Droid, where developers often publish pseudonymously, the requirement to register legal identities with a direct competitor is seen as an existential threat. Similarly, the ease of using modified apps—or "mods"—will effectively vanish, as patching an app breaks its original signature and forces the modder to register their identity with Google.

There are limited exceptions. Hobbyists and students can access a distribution tier that requires no fee or government ID, though this is capped at 20 authorized devices. Additionally, installations via Android Debug Bridge (ADB) remain open and bypass the 24-hour waiting period.

What's Next

As the 2026 regional rollout approaches, the industry will be watching whether independent app stores can find a technical workaround or if they will be forced to act as identity intermediaries for Google. For now, the primary focus remains on whether the "advanced flow" will successfully deter the average user from sideloading or simply push power users toward ADB tools.