I checked every sideloaded app on my phone against Google's new rules; here's what breaks next month

There's a date circled on Google's calendar, and it's September 30, 2026. That's when certified Android phones in Brazil, Indonesia, Singapore, and Thailand stop accepting normal installations from unverified developers.

I live somewhere else, so the global rollout in 2027 is my hard deadline, and probably yours, too. September is the warning call.

So I went through the sideloaded apps on my phone and sorted them by fate, and it's a shorter survival list than I expected.

Related

Google tries to justify Android's upcoming sideloading restrictions

But they don't go far enough

Posts 63
By  Rajesh Pandey

The paperwork Google wants before you install anything

Papers please

Developer verification is an identity checkpoint. To clear the gate, a developer hands Google a legal full name, physical address, phone number, government ID, and a $25 fee. Organizations also need a DUNS business number.

It's worth being precise about the damage here because the apocalypse framing is wrong.

Your existing unverified apps won't vanish or force close when the date arrives. Distribution is restricted, meaning no fresh installs and no updates after the regional flag turns.

This caused a backlash. Google came back with two concessions, starting with one for developers.

Hobbyists and students get a limited distribution tier with no fee and no government ID, capped at 20 authorized devices.

The second carve-out is for the rest of us, and it's called the advanced flow. Every step of it is designed to slow you down before you can install an unverified APK.

Google only allows you to install unverified apps after you turn on developer options, confirm you aren't acting on a scammer's instructions, restart your phone, wait 24 hours, and re-authenticate with a PIN or biometrics.

It's a one-time setup per device rather than a ritual per app, which is the single mercy in it.

ADB installs also stay open and skip the wait entirely, so anyone comfortable with a cable and a command line has a faster path.

It's worth stressing that this ships through Google Play Services rather than the OS, which means Google can change the rules on the server side without an Android update.

Anonymous developers have nowhere to go under these rules

F-Droid called it existential

First stop, the open source stack. F-Droid describes Google's policy as an existential threat, and I went in expecting hyperbole, but they're basically right.

F-Droid signs most builds with its own central key rather than the developer's, and a number of its developers publish pseudonymously.

Reproducible builds are the exception that ship with the developer's signature, and they cover only a slice of the catalog.

What Google wants is a signature that traces back to a verified person. What F-Droid offers is a signature that traces back to F-Droid. Those aren't the same thing. Something has to give, and it won't be Google.

As a result, installing an unverified F-Droid app the normal way stops working on a certified device and needs to be done through the advanced flow.

Even if every F-Droid user dutifully runs the advanced flow, that flow lives in Play Services, and Google can tighten it whenever it likes.

Region-locked banking apps are fine, but your modified apps don't

Patching an app breaks the signature

Next, the grey area. My phone runs beta APKs pulled from mirror sites and a couple of region-locked banking apps that never made it to the Play Store.

Mirror sites turned out to be mostly safe, which surprised me. The catch is that the original developer still has to register, because a mirrored copy of an unregistered app is as blocked as the real thing.

Same story for regional apps and things like Galaxy Store exclusives, provided the developer registers and Samsung is not about to skip the paperwork.

Modified apps are in a worse spot. The moment a tool patches an app to remove ads or add features or for any other reason, the original signature breaks, and the file has to be re-signed by whoever did the patching.

Registering means handing Google a legal name, address, and government ID, which is not a form anyone modifying other people's software is going to fill in. So mods will live behind the advanced flow.

Google's malware numbers are real, and so is the power grab

Google's argument deserves a fair hearing. It says malware is 50 times more prevalent from sideloaded sources than from the Play Store.

Phone scammers routinely walk victims through sideloading malicious apps that steal passwords and drain accounts.

Google designed the 24-hour advanced flow to break the manufactured urgency of a live social engineering call.

But the fix hands Google the identity layer for the whole operating system. Every competing app store, every independent developer, and every open source repository must register its legal identity with a direct competitor.

Nobody disputes that scam apps are a problem. We also can't ignore that the solution conveniently also gives Google control over the platform.