One thing I’ve always adored about Android is that it’s a tinkerer’s paradise. It’s a reputation that was well-earned back in the days when every new release sounded downright delectable.
Sadly, we’ve long moved past the Cupcake, Froyo, and Gingerbread era. Android still offers a lot more flexibility than its fruitier alternative, but times have changed.
Android going mainstream came with a downside for early adopters who loved its openness. Today’s digital world is dangerous, and Google has to do more to protect everyday Android users.
As we approach the end of Android’s second decade, Google is preparing to forever change the way we sideload apps, making it trickier to install them from anywhere other than official sources.
Thankfully, Google’s plans don’t seem nearly as Draconian as Apple’s infamous walled garden. It’s also likely to be a while before most folks see these changes hit their Android handsets.
The global rollout is phased
The new rules are only live in four countries
The first and most important detail to know right now is that although Google’s new policies already went live on September 30, 2026, they’re only in effect in Brazil, Indonesia, Singapore, and Thailand.
Those countries are Google’s test bed, so it can monitor how the new limitations play out in the real world.
The new protections will eventually expand beyond those countries, but Google says that won’t happen until “2027 and beyond.”
This means business as usual for most Android users. No one knows exactly when that will change, but it won’t happen overnight.
Initial enforcement is limited to official stores
Web APKs are still getting a pass — for now
In this early rollout, the limitations apply only to downloads from seven app stores: Google Play, HONOR App Market, OPPO App Market, Samsung Galaxy Store, Transsion Palm Store, vivo V-Appstore, and Xiaomi GetApps.
Developers who publish apps on these stores will need to complete Google’s verification process to stay listed, but nothing changes for those who distribute their apps through other app stores or as an APK from their website.
That will change in 2027 as it expands to “all third-party Android app stores,” so Google recommends all developers prepare to complete their verification as early as possible.
Web distribution isn’t going away
Indie developers can register to host APKs on their own websites
While we don’t know exactly when Google will begin enforcing restrictions beyond those seven stores and four countries, it’s less about taking away sideloading and more about raising the bar for developers.
Even after the full policies take effect sometime next year, independent developers who want to distribute APKs from their websites need to register for Google’s $25 Android Developer Verification program.
The only catch is that they’ll need to prove their identity to Google — typically by providing government-issued ID.
Hobbyists and students can also sign up for a free “limited distribution account” that lets them distribute apps to up to 20 devices without verification.
It will be interesting to see what happens with larger open source repositories like F-Droid and GitHub, as many developers may want to avoid registering their personal identities with Google.
Still, Android won’t prevent users from installing those apps. It will just make them jump through extra hoops.
Android’s new ‘advanced flow’ requirements
A mandatory reboot and a 24-hour waiting period
The biggest user-facing change is that users will no longer be able to toggle a switch to allow standard installations of unverified apps.
Instead, Google is introducing an advanced flow process to safeguard against scammers trying to trick potential victims into installing malware.
This will require users to not only enable developer mode in system settings, but also confirm they aren’t being “coached” to turn off their security settings.
After that, you’ll need to restart your phone to cut off any remote access or active phone calls that a scammer might be using, reauthenticate yourself, wait 24 hours, and then authenticate again to make sure you’re still you (and you still want to enable sideloading).
The good news is that this is a one-time process. After that, you can enable unverified sideloading for seven days or indefinitely.
If you choose the latter, you should be back to the same openness as before these policies came into effect, freely installing any APK you come across with nothing more than the usual “unverified” warnings.
You don’t need to leave Developer Options enabled
‘Indefinite’ sideloading permissions will stick
If you want to sideload an APK or two on your everyday device, you probably won’t want to leave Developer Options enabled, as this can make banking and enterprise apps a bit cranky. Thankfully, you don’t have to.
After you complete the advanced flow process and select Allow indefinitely, you can go back into Settings and turn off Developer Options without affecting the sideloading permissions.
Existing sideloaded apps will keep working
But updates will likely fail
The new restrictions apply only when you install a new app, so you don’t need to worry about your existing sideloaded APKs disappearing when the new policies kick in.
However, updates are part of the app installation process, so they’ll be checked for verification when they come in and trigger the advanced flow if they’re unverified.
Patch-based apps like Morphe will also fail unless they’re verified, since they often alter the original signing keys, so Android sees them as unverified and blocks updates.
Power users can still easily bypass all this
ADB, Shizuku, and custom ROMs are unaffected by the new rules
The advanced flow only applies to standard on-device installations from web sources. Command-line installations using ADB over USB or wireless debugging will work like they always have.
Google assumes that if you know how to use ADB, you won’t be duped by a scammer into loading malicious code onto your device.
The same applies to on-device tools like Shizuku, which leverage the wireless debugging features.
Custom ROMs like GrapheneOS or LineageOS are also entirely untouched by these new policies. They don’t include Google’s Developer Verifier frameworks, so there’s nothing to enforce the sideloading limitations.
A sane approach to sideloading restrictions
Android fans understandably got nervous when news of these new sideloading restrictions showed up earlier this year. After all, we’ve spent years watching Apple do everything it can to keep its App Store locked down.
However, Google’s approach isn’t about driving more traffic (and revenue) to the Play Store. It’s about protecting everyday users, while ensuring enthusiasts can still enjoy most of the same freedoms they always have.
My parents use iPhones because they’re less likely to be duped by a bad actor into hurting themselves. When these new restrictions take effect, I’ll be less nervous if they want to switch to a Pixel.
