- Google has begun testing a system in Brazil, Indonesia, Singapore, and Thailand that requires verifying the identity of developers to install apps outside of authorized stores.
- In this first phase, the control is limited to seven stores and leaves out, for now, direct downloads from websites, ADB and Spain.
- The procedure for unverified APKs includes enabling developer options, restarting and waiting 24 hours, although ADB, Shizuku or rooting offer alternative methods.
- The global expansion is planned for 2027 and raises concerns about F-Droid, GitHub and free software, while the EU monitors the plan under the Digital Markets Act.
For years, Android has been a platform where installing APKs downloaded from the internet was relatively easy. That historical freedom is entering a new phase due to Google's developer verification program, which aims to reduce malware on third-party channels. The rollout began on September 30th in Brazil, Indonesia, Singapore, and Thailand, but its initial reach was more limited than anticipated.
In Spain, for the time being, there are no practical changes for the average user. The first wave is limited to those four markets and a specific list of stores, while global expansion is planned for 2027. The European Commission is studying the plan under the Digital Markets Act, which requires allowing third-party stores and web downloads, although it permits proportionate security measures.
What changes with developer verification
The new system links each app's package name and signature key to the identity of its publisher. If the creator hasn't gone through official registration and the app doesn't come from an authorized channel, a standard installation may be blocked. Google argues that third-party apps are more likely to contain malware , but the community fears the measure will also complicate legitimate projects.
The stores participating in this phase are Google Play, Samsung Galaxy Store, Xiaomi GetApps, HONOR App Market, OPPO App Market, vivo V-Appstore, and Transsion Palm Store. APKs downloaded directly from a website, installed via ADB, or from stores not on the list are, for now, excluded. This limitation has caused confusion because many expected a blanket ban from day one. The pilot phase affects devices certified with Android 7 or higher.
The advanced procedure for unverified APKs
When the restriction is actually applied to an unverified APK, the user will have to enable developer options , check the box for unverified apps, and accept a liability disclaimer. Afterward, the device will prompt a restart and a 24-hour countdown will begin. Once the time has elapsed, the user can authorize the installation with a fingerprint or PIN and choose whether the permission lasts for seven days or is indefinite. This waiting period is generally only required once per device.
Google designed this mechanism to curb phone scams and malware attacks , but it also adds friction for those who install software outside of official app stores. Already installed applications continue to function, although they cannot be updated without going through these channels. Disabling developer options afterward does not reverse the permission granted, according to initial reports.
Impact on F-Droid, GitHub, and free software
The concern doesn't stem solely from malware precautions. Projects hosted on GitHub, repositories like F-Droid, and modified applications can be affected if altering the original APK changes its signature , causing Android to flag it as unverified. F-Droid and NewPipe have rejected the verification program, leaving their future viability dependent on a mechanism reliant on Google services.
F-Droid itself has responded with version 2.0, a major update that uses Kotlin and Jetpack Compose, adopts Material 3, and simplifies navigation with three tabs. Its unified installer allows for installation without root access and completes the process in the background, in addition to automatically updating repositories. It requires Android 7 as a minimum and arrives at a time when the Digital Markets Act is pushing for a more open ecosystem.
Spain, Europe and the Digital Markets Act
In Spain, the 24-hour blocking policy is not currently in place. The measure also does not apply to Mexico in this first phase, while Brazil is already included. In Europe, the Commission acknowledges that it is studying the plan under the Digital Markets Act , a law that requires allowing third-party stores and web downloads, but also permits strictly necessary and proportionate security measures. Its implementation in Spain in 2027 is not guaranteed.
For Spanish users who rely on apps from outside the Play Store, the recommendation is to remain calm and monitor the program's developments. Direct downloads and non-participating app stores continue to function as before. However, it's advisable to keep an eye on changes in manufacturer app stores and Google updates, as the program will be expanding.
Escape routes: ADB, Shizuku and other alternatives
Google offers an official alternative to bypass the lengthy procedure: ADB, or USB debugging , allows you to install APKs from a computer without restarting or waiting 24 hours. It's the method most supported by the company, although it does require some technical knowledge. For those who don't want to rely on a PC, Shizuku takes advantage of the debugging capabilities on the phone itself and manages installations independently of the system installer.
Rooting also removes these restrictions, as do Android ROMs without Google services, which don't use the verifier. These options aren't for everyone, but they show that APK installation isn't disappearing: it's just becoming a more controlled process . Independent developers and open-source software will be the hardest hit if the plan goes ahead.
The situation presents a mixed picture. Google wants to reduce malware, but its developer verification is changing how APKs are installed on Android. The first phase has been limited to four countries and seven app stores, with Spain excluded for now and a global rollout planned for 2027. While the EU monitors the legal compliance, ADB, Shizuku, rooting, and alternative ROMs remain open. F-Droid, GitHub, and modified apps are watching the development with concern because the developer's signature and identity are becoming the new battleground.
