Google is extending developer identity verification to every app installed on a certified Android device — including apps distributed outside Google Play, through other app stores, or by sideloading. Enforcement begins September 30, 2026 for users in Brazil, Indonesia, Singapore, and Thailand, with a wider rollout in 2027. If you ship Android apps as an indie developer or a small studio, this post covers what to register, when, which identity documents Google wants, and how the personal and organization account types differ. → It pairs with Apple's 2026 crackdown on template and low-value apps, the other big trust-and-safety shift this year.
What is changing
Google announced Android developer verification in August 2025. Today, if you publish on Google Play you are already a verified developer under Play Console rules. The 2026 change extends that requirement to all apps on certified Android devices, regardless of how they are distributed. To be installable and updatable on those devices in enforced regions, an app must be registered by a developer who has verified their identity — through Play Console, or through the new standalone Android Developer Console for developers who do not publish on Play.
Google's framing is narrow and deliberate: this is identity verification, not app review. It says it is confirming who published an app, not judging the app's content, quality, or functionality. The stated goal is to make it harder for malware operators and repeat scammers to stay anonymous across new accounts.
The rollout timeline
The schedule has moved more than once since the 2025 announcement. As of now the primary sources give this sequence:
| Date | Milestone |
|---|---|
| August 2025 | Program announced |
| Late 2025 | Early access opens for a first group of invited developers |
| March 2026 | Verification opens to all developers on Play Console and the new Android Developer Console |
| April 2026 | Android Developer Verifier appears in device system settings |
| June to July 2026 | Limited distribution accounts enter early access; Android Developer ID Status API rolls out |
| August 2026 | Android Developer Console and limited distribution accounts launch globally; advanced flow for installing apps from unverified developers ships |
| September 30, 2026 | Enforcement begins in Brazil, Indonesia, Singapore, and Thailand |
| 2027 | Expansion toward a global requirement |
The exact date early access opened is a little fuzzy: the original announcement pointed to October 2025, and Google's own "early access starts now" post is dated November 2025. The enforcement date and the four launch countries, however, are stated plainly and repeatedly in the current documentation.
Which countries, and what a certified device means
The first enforcement wave covers users in Brazil, Indonesia, Singapore, and Thailand starting September 30, 2026. In those regions, an unregistered app will be blocked from installation and updates on certified Android devices.
A certified Android device is one that ships with Google Mobile Services and Play Protect — effectively most mainstream phones and tablets sold with Google apps preinstalled. Devices without Google services, and installs performed by a developer over ADB, are outside this system. Google has said the requirement expands globally in 2027, so developers everywhere should treat 2026 as the year to get verified.
Personal account vs organization account
You verify as either an individual or an organization, and the two paths ask for different things.
- Individual (personal) account. You provide a government-issued photo ID, your legal name, address, phone number, and email. A one-time registration fee of about 25 US dollars applies to the new Android Developer Console, mirroring Play's long-standing fee. Developers who already pay for Play Console are not charged again.
- Organization account. Same personal contact details for a responsible person, plus a D-U-N-S number — the nine-digit business identifier issued by Dun & Bradstreet. If your company does not have one, you can request it free from Dun & Bradstreet, but the process can take up to 28 days, so start now if a September deadline matters to you.
Pick the type that matches how you actually operate. An organization account exposes a registered business identity; a personal account exposes an individual's verified identity to Google. Google has not published the full detail of what becomes publicly visible on listings under this program, so if public exposure of your name or address is a concern, review the account setup carefully before you submit and prefer a business address where the option exists.
Package name registration
Verification is not only about you; each app is registered too. You declare the package names you ship and prove ownership by uploading an APK signed with that app's private key, which links the signing identity to your developer account. The new Android Developer ID Status API lets you check whether a given package name is already claimed — useful before you publish, and useful if you suspect someone has registered a name you use.
Play-only vs sideloaded and alternative stores
- If you distribute on Google Play: all of your apps, across all form factors (phone, tablet, and others), must be registered.
- If you distribute outside Play — your own APK downloads, or a third-party store — enforcement in the selected regions applies to mobile and tablet form factors. Google recommends registering every app across every form factor anyway, to keep future availability intact.
- ADB installs are exempt. You can still install unverified builds on your own devices for development and testing.
What you must do: the checklist
[ ] Decide account type: individual or organization
[ ] Organization only: request a free D-U-N-S number now
(allow up to 28 days)
[ ] Gather government photo ID, legal name, address, phone, email
[ ] Sign in to Play Console, or create an Android Developer
Console account if you do not publish on Play
[ ] Start identity verification and complete document upload
[ ] Register every package name you ship
(all form factors if you are on Play)
[ ] Prove ownership: upload an APK signed with the app's
private key
[ ] Use the Android Developer ID Status API to confirm your
package names are claimed by you
[ ] If you only share test builds with a handful of devices,
consider a limited distribution account instead
The free tier for students and hobbyists
Google added a limited distribution account type in response to feedback that a fee and a government ID would push learners and hobbyists off the platform. A limited distribution account is free, does not require a government ID, and lets you distribute an app to up to 20 devices. You can later migrate a limited distribution account to a full account, but not the reverse. If you are building for a class, a club, or a few friends, this is the path.
Not a review, just identity — and the criticism
Developers and open-source communities pushed back hard on the original announcement, arguing that mandatory identity checks for sideloaded apps erode what makes Android open and could chill hobbyist and privacy-focused development. Google's response has been to keep the "identity only, not content review" framing and to add escape valves: the free limited distribution tier, no fee or ID for that tier, and an advanced flow that still lets a determined user install an app from an unverified developer after a deliberately slow, multi-step confirmation (enabling developer options, a biometric check, and a cooling-off delay) designed to defeat scam coercion rather than block power users.
Whether that balance holds is contested, and the timeline has already shifted once. The safe reading for a working developer: get verified in 2026, register your package names, and do not assume your region stays unenforced past 2027. This is general information, not legal advice.