- Only APKs from verified developers outside the Play Store will be allowed.
- The only exception to installing without verification will be via ADB.
- Play Protect hands over the reins to Android Developer Verifier, which cannot be disabled.
- Phased rollout: testing from October, activation in 2026, and global expansion in 2027.
Google is preparing a major change for Android: starting in the coming months, the manual installation of APKs downloaded from the internet will be blocked if the application is not linked to a verified developer. This measure directly targets sideloading and aims to raise the bar for security in the mobile ecosystem.
The company will make an exception for Android Debug Bridge (ADB) , the development tool that allows apps to be loaded from a computer via cable or wirelessly. At the same time, Play Protect will no longer be the verification mechanism, giving way to Android Developer Verifier , a verification system that, according to reports, cannot be disabled.
What exactly changes
Installing apps from outside Google Play will still be possible, but only if those apps are linked to a verified developer . In practice, when a user tries to open an APK downloaded from the web, the system will check the developer's origin, and if it fails verification, the installation will be blocked.
This restriction aims to address the risk associated with APKs distributed through unofficial channels. Google supports the shift in perspective, acknowledging that third-party apps pose a significantly higher risk of malware compared to those distributed through the Play Store.
The exception: ADB for developers
One option remains open for technical users: ADB (Android Debug Bridge) . This utility, designed for development and testing, allows you to connect your phone to your computer (via cable or Wi-Fi) and initiate the installation using commands. It's a more complex process than simply downloading and installing with a single tap, and requires some preliminary steps.
To use ADB, you need to enable Developer Options on your device and, if connecting via cable, enable USB debugging . This approach reduces exposure to malware because it involves additional controls and a more contained environment than open downloads.
From Play Protect to Android Developer Verifier
Until now, Play Protect handled most security checks. With the new approach, origin and authorship validation will be transferred to Android Developer Verifier , a dedicated system designed to certify the developer's identity and their connection to the app. The company has indicated that this verifier cannot be disabled , preventing the controls from being bypassed through the settings.
Deployment schedule
The implementation will not happen overnight, but will follow a phased plan that already has set dates and will begin with limited trials before expanding to more regions.
- October This year: start of testing in a small group.
- March 2026: Activation of the verification system for installations outside the Play Store.
- September 2026: Lockdowns begin in countries classified as high risk.
- 2027: global deployment of the restriction.
Motivation and context: security and market changes
Google justifies the stricter sideloading policy as a way to curb the distribution of malware , a problem more prevalent in apps from sources outside the official store. The company maintains that third-party applications can be dozens of times more dangerous, and that requiring verified developer identity creates an effective filter at the point of entry.
This move comes amid a turbulent regulatory and legal landscape. Following the dispute with Epic Games over Fortnite and the push for the Digital Services Act (DSA) in Europe, the Android ecosystem is moving toward greater openness to third-party app stores, albeit with new obligations. Against this backdrop, the strengthening of APK verification adds another layer of control over how apps reach users.
How it affects users and developers
For the average user, downloading an APK from a website and tapping "Install" will no longer work if the file doesn't come from a verified developer . Anyone needing to install an unverified app will only be able to do so via ADB , a less direct and more technical method.
Alternative app stores and distributors outside the Play Store will have to ensure their listings are signed and linked to developers who pass verification. This aims for an ecosystem with less anonymity and greater traceability of authors.
For software developers, especially independent ones, the change means formally identifying themselves so their APKs can be installed without issue. It's also advisable to review signing and distribution processes and prepare for the adoption timeline well in advance to avoid bottlenecks in key markets.
The platform is moving towards a more closed model for direct APK installation, with a limited exception (ADB) and a clear emphasis on identity verification. Those who frequently install apps from outside the official store will notice the change, while the rest of the public will barely perceive any modifications in their daily use.
