Google is increasing security measures around sideloading apps by removing anonymity for Android developers who distribute outside of the Play Store. Starting in September next year, Google will require developers in Brazil, Indonesia, Singapore, and Thailand to verify their identities in order for their apps to be installed on certified Android devices via direct downloads or third-party app stores. This requirement will then roll out globally in “2027 and beyond.”
Under the new requirements, Android developers will need to provide Google with personal details like their legal name, address, email, and phone number, and may need to upload an official government ID. Identity verification is already a requirement for Google Play, so this change mostly impacts developers who solely distribute their apps outside of the Play Store.
“By making Android safer, we’re protecting the open environment that allows developers and users to confidently create and connect,” Google said in its announcement. “Android’s new developer verification is an extra layer of security that deters bad actors and makes it harder for them to spread harm.”
This update aims to prevent users who install apps outside of Google Play from falling victim to malware and scams, making it harder for developers who release malicious apps to return under a new alias when they get removed. Apple also introduced similar developer requirements for the EU App Store in February to comply with the Digital Services Act (DSA), which requires online platforms to verify “traders” who distribute products and services to consumers in the EU through their platform.
Android developer verification is largely targeting commercial developers, with Google saying that it’s “committed to keeping Android an open platform” for student and hobbyist developers. Google is creating a separate Android developer console to facilitate this, which will place restrictions on the number of apps and installs.
Google is inviting developers to sign up for early access to the new verification rules to help “provide feedback and help us shape the experience.” That could mean some of the new requirements will change before they go into effect, given the initial rollout is more than a year away.
