As part of its ongoing efforts to combat malware and financial scams, Google has announced that it will require developer verification for installing Android apps on certified devices starting in 2026. This new policy aims to ensure the authenticity of app developers and prevent the distribution of malicious software.
To achieve this, Google is implementing a verification process for developers who want to distribute their apps outside of the Google Play Store. This includes sideloading, where users download an APK file from a third-party source. The verification process will confirm the identity of the developer, similar to how airport security checks confirm travelers' identities.
The goal is to make it harder for malicious actors to quickly distribute harmful apps after they are taken down by Google. According to recent analysis, there are over 50 times more malware from internet-sideloaded sources than on apps available through Google Play. By verifying developers, Google aims to reduce the number of convincing fake apps that can deceive users.
Developers will have the freedom to distribute their apps directly to users or use any app store they prefer. For those who only distribute outside of Google Play, a new Android Developer Console will be created. Students and hobbyists will have a separate workflow that differs from commercial developers.
However, some developers are concerned about the potential impact of this policy on legitimate developers who value their privacy or don't want to be tied to Google's centralized ecosystem. The lack of clarity on how this verification process will work is also causing uncertainty in the developer community.
Google notes that those who distribute via Google Play have likely already met these verification requirements through the existing Play Console process, which requires a D-U-N-S number for organizations. The first Android app developers will get access to verification in October 2026, with the process opening to all in March 2026.
The requirement will go into effect in September 2026 for users in Brazil, Indonesia, Singapore, and Thailand, where these countries have been specifically impacted by fraudulent app scams. Verification will then apply globally from 2027 onwards. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer.
Google has received supportive initial feedback from government authorities and other parties, including Indonesia's Ministry of Communications and Digital Affairs, Thailand's Ministry of Digital Economy and Society, and Brazil's Brazilian Federation of Banks (FEBRABAN).