Hey everyone, Eyad here.
Last month, in my iOS vs Android comparison, I wrote that sideloading has worked on Android since version 1.0. I used it to show how much more open Android is than the iPhone. A week later, Google’s new developer verification rules went live in four countries, and that line now needs an asterisk.
Quick definition first. Android sideloading means installing an app from somewhere other than the official store, usually by downloading an APK, which is Android’s app installer file.
My take up front: sideloading isn’t dead, and the scary headlines got ahead of the facts. But Google has built a checkpoint in front of every app on your phone, including apps that never touch the Play Store, and I don’t love who holds the key.
What Changed for Android Sideloading on September 30
Less than you’ve probably read. Google’s announcement limits the first phase to:
- Four countries: Brazil, Indonesia, Singapore, and Thailand
- Seven app stores: Google Play, Samsung’s Galaxy Store, Xiaomi’s GetApps, and the stores run by Honor, Oppo, Vivo, and Transsion
- Certified phones and tablets (the ones that ship with Google Play) running Android 7 or newer
In those countries, an app installed from one of those stores now has to be registered to a developer who has verified their identity with Google.
And an APK you download from a website? Nothing changed, even there. Google’s developer verification FAQ says the September deadline applies only to the participating stores, and that apps you sideload directly aren’t covered yet.
“Yet” is the word to watch. Google plans to extend the requirement to all apps on certified Android devices worldwide in 2027, and it hasn’t named a date.
How Developer Verification Works
A developer signs up with Google, proves who they are (usually with a government ID), pays a one-time $25 fee, and registers each app they publish.
Google compares it to the ID check at an airport. It confirms who the traveler is and doesn’t search the bag. Nobody reviews what the app does.
The stated reason is scams. When Google announced the plan in August 2025, it said its own analysis found over 50 times more malware in apps sideloaded from the internet than in apps on Google Play. That figure is more than a year old, and I couldn’t find an updated one.
Small developers and tinkerers get two ways around the ID check:
- Limited distribution accounts. Free, no ID, and good for sharing an app with up to 20 devices.
- ADB installs. ADB is the developer tool that installs apps from a computer, usually over a USB cable. It skips verification completely.
The 24-Hour Wait
What about an app whose developer refuses to register? For that, Google built something it calls the advanced flow. It’s a one-time unlock:
- Turn on Developer options in Settings.
- Confirm that nobody is coaching you through the steps.
- Restart the phone and sign in again.
- Wait one day.
- Confirm with your fingerprint, face, or PIN, then allow unverified apps for seven days or indefinitely.
After that you still get a warning on each unverified app, with an “Install Anyway” button. You can switch Developer options off again and the unlock stays, which matters because some banking apps refuse to run while it’s on.
The wait targets one specific scam: a caller who pretends to be your bank and stays on the line while you install their “security app.” The restart cuts the call. The day’s delay kills the urgency.
| How you install | What changes once the rules reach you |
|---|---|
| Play Store or another big store | Nothing you’ll notice |
| APK from a registered developer’s website | Nothing |
| App from an unregistered developer | One-time unlock with the 24-hour wait, then a warning per install |
| ADB from a computer | Nothing |
Why F-Droid Is Fighting It
F-Droid is an app store that carries only free, open-source apps. In February it signed an open letter against the program, alongside the Electronic Frontier Foundation, the Free Software Foundation Europe, and the Software Freedom Conservancy.
Its objection is about who’s in charge. A developer who never uses Google Play would still have to hand Google an ID, accept Google’s terms, and register every app, just to reach people’s phones. F-Droid says certified devices make up over 95% of Android devices outside China, and it advises developers never to sign up.
To be fair to Google, that letter said no advanced flow would exist before the September deadline, and it started reaching phones before then. The letter also predicted the flow would be “maximally obscure and high-friction.” On that one, F-Droid called it.
My own debloat guide sends you to F-Droid for Canta. If the apps there stay unregistered, that step picks up a one-day wait once the rules go global.
My Take
The scam problem is real, and the wait is a clever answer to it. For a relative who would never sideload anything, it’s a good default.
What bothers me is the registry. By Google’s own analogy, nobody checks the bag. The ID check doesn’t tell you an app is safe. It tells Google who to ban afterwards.
Meanwhile, every honest developer now needs Google’s sign-off to reach your phone, even through a store Google doesn’t run. It’s the pattern I complained about in my Manifest V3 post: one company changes a rule, and everyone downstream lives with it.
This one lands on me. I use F-Droid, and I use Morphe, an app-patching tool that’s only distributed through GitHub. Canta and Shizuku, the two apps from my debloat guide, and SD Maid SE all reached my phone from F-Droid or other unofficial sources. Would I sit through the 24 hours to keep them? Yes, without thinking twice.
Android used to be open by default. From 2027 it’s open if you ask, and wait a day.
What to Do Now
- If you only use the Play Store: nothing. You won’t see a difference.
- If you sideload: look in Developer options for a setting about apps from unverified developers. Google began rolling it out ahead of the deadline, and the wording varies by phone. If it’s there, do the unlock now.
- If a caller tells you to turn that setting on: hang up. That call is the scam the whole system was built for.
Pro Tip: Start the 24-hour clock on a quiet day, before you need it. Pick “indefinitely” and turn Developer options back off afterwards.
The Verdict
Android sideloading survives. Outside four countries nothing has changed, and even inside them you can still install an APK the way you always did.
The direction is set, though. Sometime in 2027, installing an app from a developer Google doesn’t know will take a one-time, one-day unlock. I can live with the wait. I’m less comfortable that one company now keeps the list of who counts as a developer.
So my iOS vs Android scorecard stands, with a footnote. Android still lets you install what you want. It just wants to know who wrote it first.
Frequently Asked Questions
Is Android sideloading being banned?
No. Registered apps install as before, from any source. Apps from unregistered developers will need a one-time unlock with a 24-hour wait, or an install through ADB.
Does this affect me outside Brazil, Indonesia, Singapore, and Thailand?
Not yet. Google says the requirement expands to certified Android devices worldwide in 2027 and hasn’t named a date.
Will F-Droid stop working?
No. But F-Droid tells developers not to register, so once the rules reach your country, expect to need the one-time unlock to keep installing and updating apps from it.
What is a certified Android device?
A phone or tablet that ships with Google Play and Google’s apps. Systems without Google’s certification, such as GrapheneOS, fall outside these rules.
