Google announced a fundamental change to the security policy of the Android operating system, which will directly impact the installation of applications from external sources. Starting in September, the company will require developers who distribute their applications outside of Google Play Store to go through an identity verification process. The initiative aims to combat the proliferation of malware, financial scams and malicious software that exploit the system’s flexibility.
The new rule directly affects the practice known as sideloading, which consists of installing APK files downloaded from third-party websites and application stores. The rollout will begin in a select group of countries, including Brasil, Tailândia, Indonésia and Singapura, with plans for global expansion over the coming months. The choice of these initial markets is related to the high incidence of digital fraud and banking Trojans spread through unofficial applications.
The company’s internal data indicates that applications installed via sideloading are more than 50 times more likely to contain some type of malware compared to those downloaded from the official store. With the measure, Google intends to create an additional barrier of protection, especially for less experienced users who can be tricked by social engineering techniques into installing dangerous applications without realizing the risks involved.
What changes with the new developer verification
The new Android security policy states that for an application to be installed from an external source on certified devices, its developer must have a registered and verified account with Google. Este process will require the provision of identification information, whether of an individual or legal entity, creating a record that associates the software with a legal guardian. Desenvolvedores who already have active accounts on Play Console, the Play Store publishing platform, will be able to use the same registration to validate the applications they distribute through other channels, simplifying adaptation. The main goal is to create a layer of accountability, making it difficult for malicious actors to distribute malware anonymously and simply create new accounts after being blocked. The verification will act as a seal of origin, allowing the Play Protect system to more effectively identify and block the installation of software from unknown or untrusted sources, protecting sensitive user data, such as banking credentials and personal information.
The measure implementation schedule
Google defined a progressive timetable for the introduction of the new requirement. An early access phase for developers to begin their vetting process is scheduled to begin in October 2025. Essa initial window will allow app creators to familiarize themselves with the requirements and prepare their software for the transition.
The general opening for registration of all interested developers will take place in March 2026. From September of the same year, the rule will come into force, and the Android system will start to actively block the first installation of any application whose developer has not completed the identity verification process.
The practice of sideloading under new rules
Although the new policy restricts the installation of apps from unverified sources, sideloading will not be completely eliminated. Google has confirmed that it will maintain the ability to install external APK files, but the process will intentionally become more complex and require more confirmation steps. The company describes this approach as creating a “high friction” flow designed to discourage accidental or coerced installs, a common tactic in social engineering scams.
For the average user, this means that installing an app from an alternative website will require navigating multiple security warnings and explicit permissions. Cada warning screen will be designed to clearly inform you about the potential dangers of installing software from an unverified source. The intent is to ensure that only users who fully understand the risks and wish to proceed on their own complete the installation, while protecting the majority from threats masquerading as legitimate applications.
Community reactions and concerns
The announcement sparked intense debate in the Android user and developer community. On specialized forums and social media, many advanced users have criticized the move, arguing that it reduces the freedom and open nature that has always differentiated Android from the more closed iOS ecosystem.
Independent developers, especially those working with open source software or emulators, have expressed concerns about being required to provide personal data to Google to distribute their projects. Eles fear that the requirement will create unnecessary barriers for small, non-commercial projects.
Alternative app stores such as F-Droid, which is popular for hosting open-source apps, may also be indirectly affected. The community is now discussing how these platforms will adapt to ensure their apps remain accessible without compromising the privacy of their developers.
Countries selected for the initial phase
The choice of Brasil, Indonésia, Singapura, and Tailândia for the initial policy rollout was not random. Estes markets were strategically selected based on data indicating a high prevalence of specific digital threats.
In Brasil, for example, there is a high incidence of financial scams that use fake applications to steal banking credentials and credit card data. Developer verification aims to make it difficult for these fraudsters to act.
Indonésia has one of the largest Android user bases in the world, with a significant portion being vulnerable to malware distributed outside official channels, making the country a crucial testing ground for the effectiveness of the large-scale measure.
Singapore, in turn, represents a technologically advanced market with strict security regulations, allowing Google to test the implementation in a more controlled environment. Já at Tailândia, the focus is to combat the proliferation of banking trojans that were developed specifically to target users in the region.
The Enhanced Role of Play Protect
The new developer verification layer is designed to work in conjunction with Google Play Protect, the security system built into Android. Atualmente, Play Protect already scans billions of applications daily to identify and block known malware, both on Play Store and external installations.
With the change, its capacity will be expanded. Instead of just reacting to already identified threats, the system will be able to act proactively, preventing the first installation of an application from an anonymous source. Isso is particularly useful for combating “zero-day” attacks or malware variants that have not yet been catalogued.
Exceptions for advanced users
Aware that a portion of its users require greater flexibility, Google confirmed that there will be an alternative flow to allow the installation of applications from unverified developers. However, this path will be designed to be deliberately more difficult to access, with even more explicit security warnings and additional confirmation steps.
Registration process details
To comply with the new rules, developers must access Play Console and follow the instructions for identity verification. Aqueles who already publish on Play Store will not need a new registration, as their information is already validated.
Google also mentioned that it is working on a simplified process for individual developers and hobbyists, seeking to balance security with the need to keep the ecosystem open to innovation and small-scale projects.
