For most of Android’s history, installing an app from outside the Play Store took a couple of taps: allow installs from this source, tap the APK, done. That’s changing. Google is rolling out developer verification, which ties apps on certified Android devices to a verified developer identity, and alongside it an “advanced flow” for people who still want to install apps from developers who haven’t verified. The advanced flow includes a one-time 24-hour wait, and it’s been one of the most argued-about Android changes in years.
Here’s how it works, when it applies, who can skip it, and why both sides of the argument have a point.
First, what developer verification is
Google announced developer verification in 2025 and set out the details in a series of posts on the Android Developers Blog. The core rule: on certified Android devices (phones that ship with Google Play services), apps must come from developers who have registered and verified their identity with Google. This applies whether the app is distributed through Play, another store, or a website.
Google’s stated reason is fraud. In its March 2026 post, it cited a 2025 Global Anti-Scam Alliance report estimating that 57% of surveyed adults had experienced a scam in the past year, with global consumer losses of $442 billion. Its argument is that malware spread through sideloading is a big part of that problem, and that anonymous developers can reappear under new names as soon as one app is taken down. Verification makes that harder. Critics, including the Keep Android Open campaign, argue it gives Google a gatekeeping role over software it doesn’t distribute, and puts hobbyist and open-source developers at a disadvantage.
The advanced flow was Google’s answer to that criticism: a way for experienced users to still install unverified apps, with enough friction to stop scammers from talking victims through it.
Why a 24-hour wait?
The design targets one kind of scam in particular. A caller pretends to be from a bank, a delivery company or tech support, creates a sense of urgency, and walks the victim through installing a “security” app that’s actually malware. These scams depend on keeping the victim on the phone and acting quickly.
The 24-hour wait isn’t a malware scan. It’s there to break that urgency. A scammer can talk someone through a few settings screens in five minutes. Keeping them on the line for a full day, across a restart, is much harder, and the delay gives the victim time to think, talk to family or call their bank directly.
How the advanced flow works
Based on Google’s description and reports from 9to5Google and others as the feature rolled out, the process looks like this:
- Turn on Developer options. Go to Settings, then About phone, and tap Build number seven times.
- Find the new setting. In Developer options, open the setting that allows apps from unverified developers.
- Read and confirm the warnings. These include confirming that nobody is talking you into turning off your security, which is aimed directly at phone scams.
- Restart the phone and sign back in. A restart ends active calls and remote-access or screen-sharing sessions a scammer might be using.
- Wait 24 hours. Google describes this as a one-time, one-day wait.
- Come back and confirm. Return to the setting, authenticate with your fingerprint, face unlock or PIN, and choose how long to allow unverified installs: for seven days, or indefinitely.
Once that’s done, you install APKs much as before, with warnings. You don’t have to repeat the 24-hour wait for each app. According to 9to5Google’s reporting, you can also turn Developer options back off afterwards without losing the setting.
Who doesn’t need the advanced flow
- Apps from verified developers. If the developer has registered, their apps install normally, even outside Play.
- ADB installs. Installing an app from a computer using the Android Debug Bridge isn’t affected. That keeps the normal workflow intact for developers testing their own apps.
- Limited distribution. Google offers a free account type for students and hobbyists that lets them share an app with up to 20 devices without a government ID or a registration fee.
- Devices without Google Play services. The requirement applies to certified Android devices. Custom ROMs without Google services and non-certified devices aren’t covered by the same checks.
When it applies
The rollout is staged:
- August 2026: Google began gradually rolling out the advanced flow and limited distribution accounts, through the Android Developer Verifier system component, so users can set things up before enforcement starts.
- 30 September 2026: verification enforcement begins in Brazil, Indonesia, Singapore and Thailand, countries Google has pointed to as having high levels of sideloading-related fraud.
- 2027: global rollout is expected.
If you’re outside those four countries, nothing changes for your day-to-day installs yet. It’s still worth knowing the steps, especially if you rely on apps from F-Droid or developers who may never verify.
What to do if you rely on sideloaded apps
- Check whether your key apps’ developers plan to verify. Many will, and then nothing changes for you.
- Set up the advanced flow before you need it. Doing it in advance means the 24-hour wait won’t catch you when you urgently need an app.
- Choose seven days if you only sideload occasionally. It limits your exposure if someone later tries to pressure you into installing something.
- Developers: use ADB for testing. It’s unaffected, and it’s the fastest route for your own builds anyway.
Is it a good trade-off?
It depends on who you are.
For most people, who never sideload anything, the change is invisible, and for anyone targeted by a phone scam it adds a real speed bump at the moment it matters. A one-time wait is also much less restrictive than blocking unverified apps entirely, which some people feared at first.
For enthusiasts and open-source users, the concerns are real. Verification requires handing identity details to Google, which some independent developers won’t do. The advanced flow is buried in Developer options, which makes it harder for ordinary users to install legitimate open-source apps. And once a gatekeeping mechanism exists, its rules can be tightened later. Those are fair points, and they’re why the change is contested.
The practical reality is that sideloading on Android isn’t going away, but it’s moving from something anyone can do in a few seconds to something you choose to set up once. If you depend on it, setting it up on your own terms, before enforcement reaches your country, is the sensible move.
Related reading
- Motorola and GrapheneOS: What the Partnership Means
- Age Verification in the Operating System
- Private Repository Security: A Practical Checklist
Sources: Android Developers Blog, Android developer verification FAQ, 9to5Google, XDA Developers, Keep Android Open (Wikipedia).
