Android Developer Verification Hits the OEM Stores First

Google began blocking unverified apps in seven Android stores on September 30, 2026, in Brazil, Indonesia, Singapore, and Thailand. The rule hits certified devices running Android 7 or higher, and it is a store policy first, not a phone-wide sideload ban.

Play was already in that group. The new partners are Galaxy Store, HONOR App Market, OPPO App Market, Xiaomi GetApps, vivo V-Appstore, and Transsion’s Palm Store, the same brands that sell most Android phones in those countries. Direct APK installs and stores outside that list still work there. Google says the identity check spreads to all apps on certified devices in 2027.

Which Stores Check Android Developer Verification?

Google Play automatically registers 99% of its apps. Developers who ship only outside Play use the Android Developer Console, pay a $25 full-distribution fee, and submit a government-issued photo ID plus proof of address. Students and hobbyists can skip the ID and the fee on a limited account that can reach 20 devices.

The September 30 cut applies to installs from the partner stores, not to every APK on the device. Google’s own FAQ is blunt about that limit, and it is the part most recaps skip.

THE SEVEN STORES IN THE FIRST WAVE

• Google Play: Auto-registers 99% of titles; remaining apps are claimed in Play Console.
• Galaxy Store: Samsung’s store on the phones that still lead Brazil and sit near the top in Thailand.
• GetApps: Xiaomi’s store on Redmi and POCO devices that hold double-digit share in Indonesia and Thailand.
• OPPO App Market: Listed under OPlus, and OPPO led Thailand shipments in Q2 2026.
• V-Appstore: vivo’s store, tied at 15% in both Indonesia and Thailand that quarter.
• Palm Store: Transsion’s store for Tecno, Infinix, and itel, the Indonesia shipment leader at 26%.
• HONOR App Market: In the first-wave list even where HONOR sits outside each country’s top five.

A developer who already publishes on Play can use that same console to register packages they also ship elsewhere. Package registration ties a signing key to a verified identity, which is the whole mechanism: Google wants a person or a company it can bar after a malware takedown, instead of another anonymous clone.

Indonesia Is Where the Store List Matches the Phones

The partner list looks random until you stack it against who actually sells phones in the first-wave countries. Indonesia is the clean match. Omdia’s Q2 2026 shipment figures put Transsion, Xiaomi, Samsung, OPPO, and vivo at 96% of the market, and each of those five has a store in Google’s seven-name group.

SHIPMENT SHARE AGAINST THE STORE LIST

Transsion and Xiaomi together held 46% of Indonesia. Add OPPO and vivo and the four Chinese Android brands reach 78%, more than four times Samsung’s 18%. Other brands, including Apple and HONOR, split the last 4%. In a market that concentrated, a rule that binds Palm Store, GetApps, OPPO App Market, V-Appstore, and Galaxy Store is a rule that binds almost every new phone that leaves a shop.

Thailand is less of a sweep and still mostly the same names. Omdia had OPPO at 20%, Samsung at 19%, Xiaomi at 16%, and vivo and Apple tied at 15%. Those five vendors held 85% of shipments. The four Android brands in that top group accounted for 70%. Apple’s 15% sits outside Android’s identity check entirely. HONOR, realme, Transsion, and the rest share the remaining 15%, and HONOR is already a listed store.

Motorola Held 31% of Brazil Without Its Own Seat

Brazil does not copy the Indonesia map. Counterpoint’s first-half 2026 figures put Samsung at 42% and Motorola at 31%, a combined 73%. Xiaomi and Apple tied at 7%. A cluster of newer Chinese brands, Jovi (vivo in Brazil), HONOR, OPPO, and realme, held 20% together, down from 26% in the first half of 2025. Xiaomi itself slipped from 11% to 7% across that year-on-year comparison.

Motorola has no store on Google’s seven-name list. That does not pull Motorola phones out of the program, because Play still runs on them and Play is a participating store. It does mean the extra lock, the one that reaches GetApps, Palm Store, and the other OEM catalogs, is thinner in Brazil than in Indonesia. Samsung users pick up Galaxy Store on top of Play. Xiaomi, HONOR, OPPO, and vivo users pick up their brand stores. Motorola users mainly meet the new check when they use Play.

Singapore is the other mismatch, and it is not an Android story in the same way. Statcounter’s mobile device vendor share in Singapore for September 2026 put Apple at 43.68% of usage, Samsung at 24.17%, Xiaomi at 8.18%, OPPO at 6.81%, and vivo at 3.11%. Usage is not the same as shipments, but the mix is still clear: a large share of devices in Singapore never see an Android store. The policy lands on the Android remainder, which is still Samsung, Xiaomi, OPPO, and vivo, plus Play.

WHO MEETS THE CHECK ON DAY ONE

• Indonesia: The five listed OEM brands are 96% of Q2 2026 shipments, so Play plus those brand stores cover almost the whole market.
• Thailand: OPPO, Samsung, Xiaomi, and vivo are 70% of shipments; Apple’s 15% is untouched.
• Brazil: Samsung’s 42% carries Galaxy Store; Motorola’s 31% still hits Play; the Chinese 20% slice carries some listed stores.
• Singapore: Apple leads usage at 43.68%; the Android minority still runs Play and the Samsung, Xiaomi, OPPO, and vivo stores.

The overlooked party is not the Western hobbyist arguing about F-Droid. It is a local developer who already ships through GetApps or Palm Store and never opened a Play Console, and who now needs a Google identity to keep installing through that OEM store in those four countries.

How Do You Sideload an Unverified App?

On a certified phone in the four countries, an app from an unverified developer will not install through those seven stores. The same APK can still be sideloaded directly, or installed from a store Google did not name, without the new check. Google’s FAQ, updated July 15, 2026, says the September 30 deadline only applies to the participating stores, and that other stores and direct sideloads are unchanged until the 2027 expansion.

WHAT WE KNOW

• Store installs: Unregistered apps are blocked from the seven participating stores in the four countries on certified Android 7+ devices.
• Direct sideload: APKs installed outside those stores do not yet need a verified developer in this phase.
• ADB: Android Debug Bridge installs skip verification, including the one-day wait in the advanced flow.
• Managed devices: Apps pushed from an organization store onto managed devices are exempt, because IT already vetted them.

WHAT IS UNCONFIRMED

• 2027 timing: Google has not published a month for the global expansion, only the year.
• Other stores: No second list of partner stores has been named for later phases.
• Custom ROMs: Devices that are not certified sit outside this program; each build still has to be checked on its own.

The practical split is already visible. A user with a PC can keep using ADB. A user with only a phone can keep sideloading from a website or a non-listed store for now, then will need the advanced flow once Google flips the global switch. Phone-only users in Indonesia, where the listed OEM stores are the default, feel September 30. Phone-only users who live on random APK sites feel 2027.

The One-Day Wait Is Built for Phone Scams

Google’s stated target is not the person who already knows how to flash a ROM. It is the person on a live call being walked through an install. Matthew Forsythe, director of product management, described the advanced flow as a one-time setup meant to break that script, and he hung the design on scam-loss figures from the Global Anti-Scam Alliance.

According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion. Because the consequences of these scams that use sophisticated social engineering tactics are so severe, we have carefully engineered the advanced flow to provide the critical time and space needed to break the cycle of coercion.

Matthew Forsythe, Director of Product Management, Android Developers Blog, March 19, 2026

The steps are the product. Each one is there to interrupt a caller who is watching the screen or pushing for a tap right now.

THE ADVANCED FLOW STEPS

1. Enable Developer Options: The setting is buried on purpose so a one-tap bypass is harder during a high-pressure call.
2. Confirm you are not being coached: A check asks whether someone is talking you into turning security off.
3. Restart and sign in again: A reboot is meant to drop remote access or an active call a scammer is using to watch the phone.
4. Wait one day, then verify: After the one-day wait and biometric check, you confirm with fingerprint, face unlock, or PIN.
5. Allow unverified installs: Choose 7 days or indefinitely; each unverified app still shows a warning you can tap through with Install Anyway.

Google opened that flow globally in August 2026, before the four-country store lock. Mishaal Rahman, who handles community engagement for Android at Google, put the company’s line in one sentence in March: “It’s of course here to stay.” The official Android Developers account used the same phrase the same day.

📣 Sideloading is here to stay.

Users will be able to install apps from unverified developers via a new advanced flow, which includes safeguards that stop scammers and maintain choice.

Learn more about how Android developer verification is evolving → https://t.co/eQWedAMc4t pic.twitter.com/vfjxzQPihQ

— Android Developers (@AndroidDev) March 19, 2026

Sideloading in that sentence means the advanced flow plus ADB, not the old tap-an-APK path with no extra gates. The wait is also a class split. Anyone who can plug into a computer skips it. Anyone who cannot, including a lot of first-time Android users on Transsion and Xiaomi phones, has to live with the store lock now and the full flow later.

F-Droid Tells Developers Not to Register

F-Droid’s objection is not about a 24-hour toggle. It is about who holds the identity database. In a February 24, 2026 open letter opposing developer verification, the project said certified devices make up over 95% of Android-compatible devices outside China, and that Google’s program would make every other store phone home to Google before an app can run.

We unequivocally advise against signing up for this program, now or ever.

F-Droid, An Open Letter Opposing Android Developer Verification, February 24, 2026

The letter argues that a future store, commercial or non-profit, starts at a permanent disadvantage if every developer must accept Google’s terms, pay a fee, upload a government ID, and register each package. Limited distribution, capped at 20 devices, is not a catalog. Full distribution is the path that keeps an app installable without extra prompts, and it is the path that hands Google a name, an address, and a signing key.

Google published a separate guide for registering open-source apps and says identity checks are not app review: nobody at Google is reading your code as part of verification. That distinction matters for malware attribution, and it does not answer F-Droid’s point about anonymous and pseudonymous maintainers. A hobbyist who will not put a passport on file is left with 20 devices, ADB, or the advanced flow. That is a workable lab. It is a poor replacement for a public F-Droid listing.

The identity demand is also why independent encrypted-mail and privacy vendors keep framing 2027 as the date that matters. Alternative stores can keep operating. Their developers still have to be on Google’s list if they want frictionless installs on certified hardware once the global switch lands. September 30 is a rehearsal of that dependency in four countries, through the stores those countries already use.

Global Checks Follow in 2027

Google has been staging this for a year. The consoles opened in March 2026. Limited accounts and the advanced flow launched in August. Store enforcement started on September 30 in four countries. The next step is the one that reaches sideloads and every remaining store on certified hardware.

THE VERIFICATION CALENDAR

1. March 19, 2026: Forsythe publishes the advanced-flow steps and the 7-day or indefinite install window.
2. August 2026: Developer APIs, limited-distribution accounts, and the power-user advanced flow launch.
3. September 30, 2026: Partner stores in Brazil, Indonesia, Singapore, and Thailand begin blocking unregistered apps on certified Android 7+ devices.
4. 2027: Google expands verification to all apps on certified Android devices, including sideloads and stores that sat out this wave.

Lost signing keys cannot be recovered for package registration, so a project that burned its key is stuck. Organizations registering for full distribution need a D-U-N-S number from Dun & Bradstreet, which Google says can take up to 28 days to obtain. Play App Signing apps are claimed automatically. Those details are boring until a small shop in Jakarta that only ever used Palm Store discovers it cannot ship an update through that store without them.

US, Indian, and European users still install unverified APKs the old way on certified phones, unless they already turned on the advanced flow. That quiet is temporary. The four-country wave is Google practicing on the OEM stores that already own Indonesia and most of Thailand, then taking the same identity check worldwide a year later. Direct sideloading is open in those four countries on October 2, 2026. It is the part of the policy that 2027 is written to close.