Android developer verification explained: what changes for sideloading and indie developers

If you build Android apps, you've probably seen the headlines: "Google is killing sideloading." It isn't. But something real did change on 30 September 2026, and a bigger change is coming in 2027.

It's called Android developer verification. In short, Google now wants to know who made an app before a certified Android phone installs it. Not what the app does, and not where it came from. Just who is behind it.

I read through Google's blog post, help pages and FAQ so you don't have to. Here's what it means for Play developers, for indie developers who share APKs, and for students.

#What verification actually is

There are two parts:

1. You verify your identity. As a person with a government ID, or as an organisation with a D-U-N-S number.
2. You register your apps. You tell Google which package names are yours, and prove it with your signing key.

Google says the goal is to stop people who spread malware from simply making a new anonymous app every time one gets taken down. In their words, they are "confirming who the developer is, not reviewing the content of their app."

That's an important line. This is not a second app review.

#The dates

• March 2026: verification launched.
• June 2026: a new system service started rolling out to most phones. It's the part that checks registration later.
• August 2026: the Android Developer Console API, free "limited distribution" accounts, and the "advanced flow" for power users launched.
• 30 September 2026: enforcement started for users in Brazil, Indonesia, Singapore and Thailand.
• 2027: it expands to all apps on certified Android devices, worldwide.

The first phase only covers phones and tablets running Android 7 or newer, and only installs from a list of big stores: Google Play, Samsung Galaxy Store, Xiaomi GetApps, OPPO App Market, vivo V-Appstore, HONOR App Market and Transsion's Palm Store.

If you live somewhere like Bangladesh, nothing is blocked for your users yet. But 2027 is close, and it's much nicer to sort this out now than in a rush later.

#If you publish on Google Play

For most of you, this is already done.

Google says over 99% of apps on Play were registered automatically. If you use Play App Signing, Google already has what it needs to link the app to you.

Still, take two minutes:

1. Open Play Console and look at the Home page.
2. If it asks you to register any apps, do it.
3. If you also ship the same app outside Play (on your website, for example), you can register it from Play Console too. You don't need a second account.

Google warned that Play apps that weren't registered by 30 September 2026 risked being removed from Play everywhere, not just in the four countries. So if you have an old app you haven't opened in a while, check it.

#If you share apps outside Play

This is the group that needs to do the most work.

You'll use the Android Developer Console. It's a separate console made for developers who don't use Play. There are two kinds of account:

• Full distribution: a one-time $25 fee and a government ID (or a D-U-N-S number for an organisation). No limit on users.
• Limited distribution: free, no government ID, but your app can only go to up to 20 devices. You can upgrade to a full account later, but not go back.

To register an app, you:

1. Enter the package name.
2. Enter the SHA-256 fingerprint of your signing certificate.
3. For an existing package name, sign a small APK with your private key and upload it. That proves the app is really yours.

You can get the fingerprint like this:

keytool -list -v -keystore release.jks -alias release

Look for the line that starts with SHA256:.

One warning from Google that's easy to skip: if you lose your signing key, you can't register that package. If your keystore lives on one old laptop, now is a good time to back it up properly.

And if you're registering a company, the D-U-N-S number is free from Dun & Bradstreet, but it can take up to 28 days. Google also warns about third-party sites that charge high fees for it. You don't need to pay anyone.

#If you're a student or hobbyist

The limited distribution account is made for you. No fee, no ID, up to 20 devices. That's enough for a class project, a demo for a client, or an app for your family.

If more people want your app later, you can move to a full account then.

#What still works

This is the part the scary headlines leave out.

• ADB still works. Google says developers can still use ADB to build, test and install apps on their own devices. Apps installed with ADB don't need verification.
• Sideloading still exists. Users can turn on an advanced flow once. It needs developer mode, a restart, a one-day wait, and then a fingerprint or PIN. After that, they can install apps from unverified developers, with a warning.
• Company apps are fine. Apps from an organisation's managed store don't need verification.

So Android is still open. It just has one more step for apps from people Google can't identify.

#What happens if you do nothing

In the countries where it's switched on, apps from unverified developers can't be newly installed from the stores on that list, on certified devices.

In 2027, that goes worldwide.

#My checklist

Here's what I'd do this week:

1. Open Play Console and check the Home page for apps that still need registering.
2. List every app you ship outside Play, and every package name.
3. Find each signing key. Back them up in two safe places.
4. Pick your account: full ($25) or limited (free, 20 devices).
5. If you're a company, apply for a D-U-N-S number now. It can take weeks.
6. Register each package name with its SHA-256 fingerprint.
7. Tell your testers that ADB installs still work for test builds.

It's a small amount of work. The only real risk is the lost signing key, so start there.

If you're also getting your app ready for Google Play's next deadline, read my post on the 16 KB page size requirement.

#Sources

• Android developer verification: Building a safer ecosystem together — Android Developers Blog
• Understanding Android developer verification — Android Developer Console Help
• Android developer verification — Android Developers
• Developer verification FAQ — Android Developers
• Android Developer Console guide — Android Developers