Android developer verification: who it affects and what to do

Google is changing how apps get onto Android devices. A certified phone or tablet will only install an app registered by a verified developer. The first countries came under the rule on 30 September 2026, for now only for installs from selected stores. In 2027 Google will extend it worldwide and to all apps, wherever the file comes from.

If your app is only on Google Play, it has most likely been registered for you already. If you distribute it another way, for example to staff or clients, you will need to register in a new console.

What verification involves

There are two parts:

1. Identity. You confirm who you are, as a person or an organisation.
2. Package name registration. You link the app's package name to its signing key and to your account.

The rule covers certified devices running Android 7 or later. Google delivers it through Google Play services.

Google's reason is security. In March 2026 it said its analysis found over 90 times more malware from sideloaded sources than on Google Play. Identity checks are also meant to make it harder for the authors of a harmful app to release another one quickly.

Dates

• March 2026. Verification opened to all developers in Play Console and in the new Android Developer Console.
• August 2026. The free limited distribution account and an advanced flow for people who knowingly install unregistered apps became available.
• 30 September 2026. The rule took effect in Brazil, Indonesia, Singapore and Thailand. It covers installs from seven stores: Google Play, HONOR App Market, OPPO App Market, Samsung Galaxy Store, Palm Store, vivo V-Appstore and Xiaomi GetApps. The Android Developer Console Help lists only three countries, without Brazil. Google's other pages list four.
• 2027. The rule will extend worldwide to all apps on certified devices. Google has not given a month. We found nothing specific about Poland or the EU either.

The first phase does not cover apps installed from a file downloaded from a website. Google says they will be covered in 2027.

Apps only on Google Play

Most Google Play developers need to do nothing new about identity. Google automatically registered 99% of Play apps. A new app is registered when you create it in Play Console. Apps that use Play App Signing are also registered automatically.

The remaining 1% had to be registered by hand by 30 September 2026. Google said apps not registered by that date would be removed from Google Play.

To check the status in Play Console:

1. On the Home page, a notice above the app list shows any apps that still need registering.
2. The Android developer verification page shows the status next to each app.

On Google Play, registration applies to every device type, not only phones and tablets.

Apps outside Google Play

This part covers APK files on your own website, other stores, and apps sent directly to staff or clients. If an app is only distributed outside Google Play, you register it in the Android Developer Console. If it is also on Google Play, Play Console is enough.

A full distribution account costs USD 25. To be verified you need:

• As a person. Government-issued photo ID and proof of address. You confirm your email and phone with a one-time code.
• As an organisation. A D-U-N-S number, a company website verified in Google Search Console, and company documents. The D-U-N-S number is free, but getting one can take up to 28 days.

Then you register each app. You enter the package name and the SHA-256 fingerprint of its certificate. For an existing app you upload an APK signed with your private key. Without the signing key you cannot register the app, so check now where it is kept and who can use it. If two developers claim the same package name, the key with more than half of the known installs takes priority.

In the first phase, outside Google Play the rule only covers phones and tablets.

Company apps on staff phones

Apps from a company store on managed devices do not need verification for now. This applies to private apps installed through device management (EMM) or in a work profile. Google still recommends registering them. If the same app also goes onto personal, unmanaged phones, it must be registered.

An account for learning and personal projects

Students, teachers and hobbyists can open a limited distribution account. It is free and needs no ID. You do need a Google Account with 2-Step Verification and a Google payments profile.

This account lets you install an app only on specific devices. Google's pages give different limits. The guide to this account says 50 devices, while Google's other pages say 20.

What users will see

An unregistered app cannot be installed from those seven stores in countries where the rule is live. Its updates will not install either.

The exception is an advanced flow for people who knowingly install such apps. It is set up once:

1. Turn on developer options.
2. Confirm that nobody is coaching you through it.
3. Restart the phone and sign in again.
4. After 24 hours, confirm with biometrics or a PIN.
5. Allow installs for 7 days or indefinitely.

Developer options do not have to stay on afterwards. Every install still shows a warning with an "Install Anyway" button. Developers can also install apps over ADB with no verification and no wait.

For an app you give to clients, this is the wrong route. Not everyone will get through these steps, and the warning puts people off.

What to do now

• App on Google Play. Open Play Console and check the status on the verification page.
• App outside Google Play. Create an Android Developer Console account. If you are registering as an organisation, apply for a D-U-N-S number straight away. Find the signing key for each app.
• Company app. Check whether it only goes onto managed devices. If not, register it.

This describes the position on 8 November 2026. Google is introducing the changes in stages, so read its current pages before you register. If your app is distributed outside Google Play and you would like help with registration, write to us.