Google has announced that starting September 30, 2026, certified Android devices in Brazil, Indonesia, Singapore, and Thailand will block normal installations of apps from developers who have not completed identity verification. The policy applies to apps distributed through Google Play as well as third-party stores from Samsung, Xiaomi, OPPO, vivo, Honor, and Transsion.
To enforce this, Google is rolling out the Android Developer Verifier system service to devices running Android 8 and newer. This service checks whether an app is registered to a verified developer before allowing installation. Unregistered apps can still be installed via Android Debug Bridge (ADB) or through a high-friction advanced flow that requires enabling developer mode, a 24-hour wait, and reauthentication. That advanced flow goes global in August 2026.
Developer registration opened in March 2026. To register, developers must provide a legal name, address, contact details, and possibly a government ID, and prove ownership of each app by submitting an APK signed with their private key. Google is also introducing APIs for bulk registration and package-name checks in July 2026. A separate free limited-distribution account for students and hobbyists, allowing up to 20 devices without a government ID or fee, enters early access in July and launches globally in August.
Google cites malware prevention as the primary reason, noting that sideloaded sources carry significantly more malware than Google Play. The four launch countries were chosen due to high rates of app scams. However, the policy has faced strong opposition from the open-source community. F-Droid, a free-software app repository, says the requirement would end its project because it relies on pseudonymous contributors. The Keep Android Open campaign, backed by over 70 organizations, has asked Google to drop ID checks for apps shipped outside Play. Google’s concessions—the advanced flow and 20-device accounts—do not address the core concern of a single company controlling the installation path for nearly all Android devices outside China.
Three key questions remain before the global rollout in 2027: an appeals process for mistakenly flagged developers, data retention policies for the identity registry, and a path for repositories like F-Droid that cannot meet per-app ownership checks.
CVEs: CVE-2026-11645
Companies: Google, Samsung, Xiaomi, OPPO, vivo, Honor, Transsion
Products: Android Developer Verifier, Android Developer ID Status API, Android Developer Console API, Google Play, Google Play Protect
Events: Android Developer Verification Deadline September 30 2026, Android Developer Verifier Rollout June 2026, Advanced Sideloading Flow Global August 2026, Android Developer ID Status API and Console API July 2026, Limited Distribution Account Early Access July 2026, Limited Distribution Account Global Launch August 2026
Original source: thehackernews.com