Android now checks who built an app before it installs it

What changed on 30 September

For most of Android's history, a phone would install any app you handed it once you allowed "unknown sources". That is no longer true everywhere. Since 30 September 2026, certified Android devices running Android 7 or later in Brazil, Indonesia, Singapore and Thailand only install an app through the normal path if its package name is registered to a developer whose identity Google has verified.

It does not matter where the app comes from. The check applies to installs from Google Play, from the six other participating stores (HONOR App Market, OPPO App Market, Samsung Galaxy Store, Transsion Palm Store, vivo V-Appstore and Xiaomi GetApps) and from an APK downloaded off a website. Google says the requirement expands to the rest of the world from 2027.

Verification confirms who made an app, not what the app does. Google's argument is that malware spreads through throwaway identities: a developer who has to stand behind a real name, address and signing key is much harder to recycle after getting caught.

How an install is checked now

The check happens on the phone, before the app installs. Scroll through the path an install takes.

The advanced flow, for people who want to install anything

Google did not remove sideloading. It made it deliberate. The advanced flow, which launched globally in August 2026, is a one-time setup designed so that nobody can be talked through it in a hurry by a scammer on the phone.

The one-day wait is the important part. Scams that push people into installing a fake banking app depend on urgency, and a day is long enough to call someone you trust. For developers, nothing about this flow is needed: ADB keeps working exactly as before, so adb install during development and testing is unaffected.

Who has to do something

The timeline, from announcement to worldwide

1. March 2026Verification opens to every developerIn Play Console and the new Android Developer Console.
2. June 2026Android Developer Verifier reaches phonesThe system service that runs the check before an install.
3. August 2026Limited distribution and the advanced flow launchPlus developer APIs for registration status.
4. 31 August 2026Play requires Android 16 targetsA separate deadline, covered below.
5. 30 September 2026Enforcement starts in four countriesBrazil, Indonesia, Singapore and Thailand.
6. 2027 onwardsWorldwideGoogle says verification expands globally.

The other deadline: target Android 16

Separate from verification, Google Play's yearly target API rule moved on 31 August 2026. New apps and every app update for phones and tablets must now target Android 16, API level 36. Developers who needed more time could request an extension to 1 November 2026, which is this week.

Apps you are not updating have their own bar: to stay available to new users on newer Android versions, an existing app must target at least Android 15 (API 35). People who already installed it keep it either way.

android {
    compileSdk = 36

    defaultConfig {
        minSdk = 26
        targetSdk = 36
    }
}

A checklist for any Android app this month

Tick them off as you go. Your progress stays in this browser.

• Complete developer verification on your Play Console account, as a person or an organisation.
• Check every app's registration status in Play Console, including old apps you still keep live.
• Register packages you ship outside Play in the Android Developer Console, with an APK signed by the real key.
• Verify your website in Search Console if you register as an organisation.
• Target API 36 for phone and tablet updates, and publish before your extension runs out on 1 November.
• Tell testers how to install: a limited distribution handshake, ADB, or a Play testing track.