Android’s First ID Checks Land Inside Seven App Stores

Android developer verification took effect on September 30, 2026 in Brazil, Indonesia, Singapore and Thailand. The live rule covers seven partner app stores on certified phones, not every APK a user can still tap to install.

Google Community Engagement Manager Mishaal Rahman said on October 2 that verification is enforced only for those stores. Users in the four countries can still install apps from unverified developers outside them, without the 24-hour Advanced Flow.

The Four-Country Switch Landed on App Stores

Google’s public timeline is narrower than the first wave of headlines. Protections began for people who install apps from participating stores in the four countries, on certified devices running Android 7+. The company says a wider pass, covering all apps on certified Android devices, comes in 2027.

That split is the whole first-wave design. A title in Galaxy Store or GetApps now needs a developer who has registered with Google. A random APK from a website, GitHub, or a store that is not on the partner list does not hit that gate yet. Google’s own FAQ says those other channels are not covered in this first phase.

Play users who only install registered apps should see no new prompts. Matthew Forsythe, director of product management, wrote on June 18, 2026 that millions of apps have been registered since March and that over 99% of Play developers’ apps are already on the list.

WHAT WE KNOW

• The live gate: From September 30, 2026, participating stores in the four countries block new installs of unregistered apps on certified Android 7+ devices.
• The open path: Sideloading and stores outside the seven-name list still install without Advanced Flow in those countries, per Rahman and Google’s FAQ.
• The later pass: Google says verification will expand globally in 2027 to all apps on certified Android devices.
• The old apps: Packages already on a phone keep running; updating an unregistered one later can still require a bypass.

WHAT IS UNCONFIRMED

• The 2027 month: Google has not posted a start date inside that year.
• The location test: Public docs do not spell out whether a phone counts as “in” Brazil, Indonesia, Singapore, or Thailand by SIM, account, or GPS.
• Open-source keys: Google has a registration guide for open-source apps, but F-Droid still tells maintainers not to enroll, so the 2027 user experience for that catalog is unsettled.

The Advanced Flow itself is already on phones. Google began rolling it out in August 2026 as the power-user path for unregistered apps. It is a bypass built for a later, wider lock, not the thing that flipped on September 30 for ordinary sideloads.

Seven Partner Stores Now Check Every Developer

The first-wave list is an industry pact, not a Play-only rule. Forsythe’s June post names the stores that now have to treat developer identity as a shipping requirement in those four markets.

THE SEVEN STORES IN THE FIRST WAVE

Those OEM storefronts are the hidden parties. In Indonesia, Thailand, and Brazil, a lot of people already get apps from the maker’s own shop, not only from Play. Once those shops refuse unregistered developers, the frictionless mass-market path in those countries shrinks to Play plus a short list of brand stores.

Independent catalogs are still legal in this phase. They are also no longer peers of Galaxy Store or GetApps. A verified developer can still ship from a website or a smaller shop with the old one-tap install. An unverified one cannot use the seven partner stores at all in the four countries, and will need Advanced Flow or ADB once the 2027 pass arrives.

Enterprise apps on managed devices sit outside the check, the FAQ says, because an IT admin has already vetted them. Custom builds that are not certified Android devices sit outside it too. The rule follows Google’s certified image, not every phone that can run an APK.

Why Brazil, Indonesia, Singapore and Thailand Went First

Google picked the four countries as a high-scam test bed. Forsythe’s March 2026 Android Developers Blog post said analysis found over 90 times more malware from sideloaded sources than on Google Play. The FAQ’s threat model is more specific than a junk-APK website: a live caller who walks a victim through installs while the victim is still on the phone.

Identity is meant to stop the next-day clone. After a bad app is pulled, a new anonymous package can replace it in hours. A government ID and a claimed signing key make that loop more expensive. Google is not reviewing each APK in this program. It is binding a package name to a person or a company.

The store list fits that map. Transsion’s Palm Store, Xiaomi GetApps, vivo, OPPO, HONOR, and Samsung already hold distribution in the same markets where Play does not own every install. Putting them in the first wave means a scammer cannot simply leave Play and keep a one-tap listing on an OEM shop in Jakarta or São Paulo.

Play-only users are not the audience. They were already inside Google’s identity system. The new work falls on OEM store operators, who now have to keep unregistered listings off the shelf, and on small developers who used those shelves without a Google account.

Google Built a One-Day Pause for Phone Scams

Advanced Flow is a one-time device setup, not a delay on every file. Google’s FAQ walks through why each step exists. Developer Options stops a one-tap bypass. A coaching prompt asks if someone is talking you into turning security off. A restart is meant to kill a remote-access session or an active call. Then the clock starts.

THE ADVANCED FLOW STEPS

1. Unlock Developer Options: Tap the build number seven times in About phone, then open Settings, System, Developer Options.
2. Flip the unverified-apps toggle: Turn on Allow apps from unverified developers and confirm the screen lock.
3. Confirm you are not being coached: Accept the prompt that no one is directing you to disable protections.
4. Restart and wait: Reboot, then sit through a one-time 24-hour pause before the setting can finish.
5. Come back and choose a duration: Authenticate again with PIN or biometrics, then allow unverified installs for seven days or indefinitely.
6. Install anyway: The package manager still warns that the developer is unverified; you tap Install Anyway.

The wait is the anti-scam product. A caller who needs a banking APK installed during the call cannot hold the line for a day. A person who already wanted F-Droid or a GitHub build can start the clock and come back tomorrow.

Scammers rely on manufactured urgency, so this breaks their spell and gives you time to think.

Android developer verification FAQ, Google

Google previewed that flow in a short official video. The restart, the wait, and the second sign-in are the point of the clip, not a hidden menu buried in a blog comment.

ADB does not use this path. The FAQ says developers remain free to install unverified apps over Android Debug Bridge, with the same workflow as before. That keeps lab testing intact. It also means anyone who already uses a cable and a computer never meets the 24-hour clock.

Leave the toggle on indefinitely and the extra taps go away for later APKs, though the unverified warning still appears. Choose seven days and the permission expires. Turning Developer Options off later is a separate switch; the unverified-apps grant is the one that matters for installs.

F-Droid Refuses to Hand Google an ID

The catalog that actually lives on unregistered software is not an OEM store. F-Droid distributes free and open-source apps without Google accounts, often signed by the project rather than by each volunteer. Google’s program wants a real-world identity and a claimed signing key behind each package. Those two models do not meet in the middle.

On February 24, 2026, F-Droid published an open letter opposing developer verification and joined a coalition at keepandroidopen.org, alongside groups such as the Electronic Frontier Foundation and Free Software Foundation Europe. The letter treats “sideloading is not going away” as the wrong reassurance. Direct install, in their reading, stops being a right you exercise on a device you own and becomes a privilege Google administers.

We unequivocally advise against signing up for this program, now or ever.

F-Droid, Open Letter Opposing Android Developer Verification, February 24, 2026

F-Droid also put a number on the certified-device net: more than 95% of Android-compatible devices outside China. That is why a Play-services check reaches almost everyone who did not install a custom image. GrapheneOS, CalyxOS, and LineageOS sit outside certified Android as Google defines it here, so the identity lookup does not follow those builds. That is already the practical advice in privacy circles, and it is the cleanest legal exit the docs leave open.

Google did add a registration path for open-source apps, and a free limited account for hobbyists. F-Droid’s stance is that enrolling still binds maintainers to Google’s terms, a fee or an ID, and a central list of package names. For a repository that exists so people do not have to deal with Google, that is the concession it will not make.

Patched clients and re-signed APKs hit a second wall even if the original developer is verified. Change the signing key and the system treats the file as a different, unverified app. Community mods that cannot keep the upstream key will need Advanced Flow or ADB once enforcement reaches all installs, not only the seven stores.

A $25 Account, a 20-Device Free Path, and ADB

Google split developers into three lanes so it could say Android is still open. The lanes are not equal. Only the paid, ID-checked account restores the ordinary install everywhere, including the seven partner stores in the four countries.

THREE WAYS TO SHIP AN ANDROID APP NOW

The $25 fee matches Play’s old registration charge, and Google says it covers admin costs. Organizations that lack a D-U-N-S number can request one at no cost from Dun & Bradstreet, though the FAQ warns that process can take up to 28 days. Lose the signing key and you cannot claim the package. That is a hard stop, not a support ticket.

Limited accounts are the student and hobbyist hatch. They let a person up to 20 devices without a government ID and without the fee. Twenty phones is a class, a family, or a test bench. It is not a public catalog. Anyone who wants strangers to install the build still needs full distribution or has to tell those strangers to run Advanced Flow.

Anonymous public shipping is the lane that shrinks. It still exists on paper. In the four countries it already cannot use the seven partner stores. In 2027, on certified devices, Google says it will need the one-day setup or a cable. That is the trade the company is willing to make: keep the capability, tax the impulse.

What Happens When Verification Goes Global in 2027

The four-country launch is a rehearsal with real shelves. OEM stores in those markets now have to match Play’s identity bar. F-Droid and other unregistered catalogs still reach users by direct install, which is why the sky did not fall on September 30. The 2027 line on Google’s table is the one that would make Advanced Flow a mass-market setting instead of a preview.

THE VERIFICATION CALENDAR

1. August 2025: Google announces that certified Android devices will require apps to be registered by verified developers.
2. March 2026: Identity verification and app registration open to all developers on Play Console and Android Developer Console.
3. August 2026: Limited distribution accounts, developer APIs, and Advanced Flow begin to roll out.
4. September 30, 2026: Partner stores in Brazil, Indonesia, Singapore, and Thailand start blocking unregistered apps on certified Android 7+ devices.
5. 2027: Google says it will expand verification to all apps on certified Android devices after taking feedback.

Rahman’s October 2 note is the status that still holds: the stores are closed to unregistered listings in the four countries, and the sideload path beside them is not. Developers who ship through those stores and have not finished registration are the ones who lost a channel on September 30. Everyone else is on the clock for a year Google has not pinned to a month.

The identity list will be the durable product. OEM stores already treat it as a shipping rule. F-Droid still will not join it. Certified phones in four countries now live with that split, and the rest of the certified Android base is next.