Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
Android Google

Google To Require Identity Verification for All Android App Developers by 2027 (androidauthority.com) 97

Posted by msmash from the bad-guys-ruined-it-for-everyone dept.
Google will require identity verification for all Android app developers, including those distributing apps outside the Play Store, starting September 2026 in Brazil, Indonesia, Singapore, and Thailand before expanding globally through 2027. Developers must register through a new Android Developer Console beginning March 2026. The requirement applies to certified Android devices running Google Mobile Services. Google cited malware prevention as the primary motivation, noting sideloaded apps contain 50 times more malware than Play Store apps.

Hobbyist and student developers will receive separate account types. Developer information submitted to Google will not be displayed to users.

Google To Require Identity Verification for All Android App Developers by 2027 More | Reply

Google To Require Identity Verification for All Android App Developers by 2027

Comments Filter:

  • Who to smack (Score:3)

    by AcidFnTonic ( 791034 ) on Monday August 25, 2025 @01:48PM (#65614652) Homepage

    If you write any code they dont like they need to be able to find you to smack you.

    Also the future is showing where being a developer is allowed only if you toe the line.

    Eventually some day in my life I may be arrested for illegally possessing a C++ compiler.

  • Of course they have to verify the people they're paying. It's called "KYC", Know Your Customer. Allowing platforms to pay and accept payment from completely anonymous accounts has always lead to money laundering, extortion and fraud. Financialization without KYC is how Roblox was able create a massive supply chain of child labor.

    KYC isn't needed for communication on the internet but it's absolutely needed for financialization on the internet.

    • This is not KYC (Score:5, Interesting)

      by Anonymous Cward ( 10374574 ) on Monday August 25, 2025 @02:04PM (#65614714)
      They want the identity information for all software, not just software being sold on Play Store. This means software where no money changes hands, and which Google does not even supply, now requires identity checks. Welcome to the slippery slope where nobody can write their own code without large technology companies knowing who wrote it. If you want trustworthy tools like Veracrypt, BitTorrent, Gnutella etc. to exist on mobile platforms, you do not want this to happen.
      • You still can write or install your own software. That doesn't mean Google should be forced to distribute it through their store. This is targeting scammers or malware purveyors, but I don't think it will be successful at stopping any organized entities. It's not as though it's impossible to steal or fake an IF and if there's enough money involved services will pop up to buy and sell clean IDs.

        • Re:This is not KYC (Score:5, Informative)

          by Himmy32 ( 650060 ) on Monday August 25, 2025 @03:36PM (#65614956)

          You still can write or install your own software.

          If you identify yourself for an Android Developer account.

          That doesn't mean Google should be forced to distribute it through their store

          This is explicitly for things not on the Play Store. This would apply to sideloading or from alternate stores like F-Droid.

          I don't think it will be successful at stopping any organized entities.

          Then why is it ok to remove developer privacy?

          • I think you're kinda gaslighting yourself. This, verifying developer accounts, is not a "freedom of software" issue. However, Google removing the ability to sideload apps that didn't come from the store is 100% an egregious violation of consumer rights and basic human morality

            In an environment where sideloading exists, there are plenty of ways to distribute apps without needing a verified developer account.

            Every platform is dealing with the same problem of regulators realizing they were filled with a mas

            • Re: (Score:2)

              by Himmy32 ( 650060 )

              In an environment where sideloading exists, there are plenty of ways to distribute apps without needing a verified developer account.

              Except for where you can't sideload apps where the app package name and app signing key isn't registered against a known developer account.

              keep arguing against KYC for the Play Store.

              Really I think you should read the article and on Google's developer verification site [android.com]. Note that it's not all Play Store apps, but all apps on Google certified Android devices.

              Stated again on the Google Play Support pages [google.com] as:

              all Android apps must be registered by verified developers in order to be installed on certified Android devices - including through Google Play - in Brazil, Singapore, Indonesia, and Thailand. A global rollout will follow.

        • Re:This is not KYC (Score:4, Insightful)

          by Powercntrl ( 458442 ) on Monday August 25, 2025 @03:42PM (#65614970) Homepage

          You still can write or install your own software. That doesn't mean Google should be forced to distribute it through their store.

          I know it's /. tradition to only read the headline and jump to your own conclusion from there, but this change affects all Android development. Without Google's signature, not even your sideloaded "Hello world" app will install.

          What this could also potentially kill is the app modding community, since most of the people working on that sort of stuff aren't really interested in receiving nastygrams.

          • You can have all the privacy you want. Don't distribute your software via Google.

            • Re:This is not KYC (Score:5, Insightful)

              by Powercntrl ( 458442 ) on Monday August 25, 2025 @05:29PM (#65615280) Homepage

              You can have all the privacy you want. Don't distribute your software via Google.

              That's not how this is going to be implemented. If you don't register with Google, you won't be able to sign your apps with a valid key and they won't even be sideloadable. Google is basically taking a page out of Apple's book, after seeing how Apple chose to implement their own version of sideloading.

              It's kind of like the removal of the headphone jack all over again. Apple tends to be something of a trendsetter in user-hostile behaviors.

              • Right. So don't distribute your apps via Android.

                You can just publish your project files and let people build and install it themselves. Total privacy for you.

                • Considering that Google has moved the goal posts multiple times already, why should we believe you, a random /.er, over precedent?

                  They already made custom ROMs lesser than official ROMs through Android Verified Boot's boot status system. (Where even a signed custom ROM is considered less trustworthy than a manufacturer signed official ROM by Play Services.)

                  They already banned custom ROMs via Play Protect / SafetyNet.

                  They already made it so that Play Services scans every app installed regardless of ori

              • It's kind of like the removal of the headphone jack all over again. Apple tends to be something of a trendsetter in user-hostile behaviors.

                Actually it's nothing like that. Apple may have removed the headphone jack irking users, but the reality is most Android devices didn't follow suit for many years once most people migrated away from wired headphones anyway. The removal of the headphone jack for Apple was user hostile, but the removal of it on android devices was more akin to shipping computers without floppy disks.

                If you want a headphone jack buy a phone with one. There's plenty on the market. Not every phone needs every feature for every p

            • Unfortunately, we don't have right to repair, so we can't bypass the code signing process, and if you made a tool to do so, it would likely violate the DMCA.

        • Re: (Score:2)

          by EvilSS ( 557649 )
          This is specifically targeting apps not in the Play Store.

          Today, Google announced it is introducing a new “developer verification requirement” for all apps installed on Android devices, regardless of source. The company wants to verify the identity of all developers who distribute apps on Android, even if those apps aren’t on the Play Store. ... Only users with “certified” Android devices — meaning those that ship with the Play Store, Play Services, and other Google Mobile Services (GMS) apps — will block apps from unverified developers from being installed.

          Starting in September 2026, Android will require all apps to be registered by verified developers in order to be installed on certified Android devices.

          And BTW "certified Android devices" is most main stream phones sold in stores, the ones most people own. Yes, you can roll your own Android on some phones and this one be an issue, but it will affect the vast majority of devices and users out there.

        • We're NOT talking Google store here, we're talking about side loading, which by definition does NOT use Google's store.

      • Re: (Score:2)

        by bjoast ( 1310293 )
        This is insanely dystopian.

      • Sorry but no, fuck off with the slippery slope argument. Google is pretending to offered a curated wall garden through their play store but not implementing basic fraud protections. There should be no right to publish anything in the play store without identity verification.

        If you want to push custom code from unverified sources to your phone, sideload like a normal person. Right now we're in the shitty situation where Google is gatekeeping in a way that provides no benefit of gatekeeping. Go one way or the

    • Sadly, I can't have an unverified developer account for my free stuff, and then prove my identity when I decide to try and make money. As such, I have to conclude their reasons for doing this are not entirely KYC.

  • Like... they're hosting the software, they have a reasonable need to know who's giving them the software, and an absolute right to refuse to host it if you won't tell them.

    As long as you can sideload apk's still of course. Take that away, and it changes a lot.

  • It's a good thing there aren't such things as fake Ids, bogus addresses, etc. that scammers can use; I'm sure they will give up real names and addresses.

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      There will probably be an exception for developers who need to test code out, and if they try to ban any useful apps like the Revanced stuff it won't take long for people to enable those. I already have because developer mode is needed for certain things like open source apps in Android Auto.

  • I'm a pink deer.
    I frolic in the Marshmallow Forest.

  • Defeating the point of side loading (Score:5, Insightful)

    by BrightCandle ( 636365 ) on Monday August 25, 2025 @02:18PM (#65614756)
    The entire point of side loading was that it didn't require being signed and checked via the playstore and Google. Not surprisingly people have been using it to get hold of software that Google doesn't want you to have. Its an essential mechanism for development or just testing things out. We badly need an open platform for mobile, Google is locking Android down now, the replacement ROMs are getting shut down with the lack of distributed OS and now this. None of this about security its about lock in and control.

    • GrapheneOS, CalyxOS, LineageOS, etc are out there.

      The device support is limited because these projects are small. But if you think about it, Google itself mainly releases Android read-to-go for Pixel phones and a handful of partner devices. And Google's resources are several orders of magnitudes larger than that of an open source project.

      I recent swapped out my wife's cheap Motorola for a Pixel precisely because I wanted to get us all on a platform where we have more control and where we can disable invasiv

      • "I recent swapped out my wife's cheap Motorola for a Pixel precisely because I wanted to get us all on a platform where we have more control and where we can disable invasive AI and microphone monitoring that seems to be the latest fad in the mobile industry"

        But that makes no sense. Google is one of the most invasive purveyors of that crap, and Moto/Lenovo only pushes Google's on you just as Google does, so what you've accomplished is spending more for a phone that will do exactly the same amount of unwante

    • Re: (Score:2)

      by allo ( 1728082 )

      As far as I understand it, you still sign yourself, but Google needs to give you a certificate for your signing key. This then allows Google to revoke your certificate and render all your apps useless, but does not tell them what apps you're signing.

      • Re: (Score:2)

        by allo ( 1728082 )

        Of course they still know what apps you're signing, as Play Protect scans the phones of billions of Google users.

    • I thought the point of side loading was to avoid having to go through the Play Store, given its high commission costs.

  • This is sideloading being locked. (Score:3)

    by kurkosdr ( 2378710 ) on Monday August 25, 2025 @02:32PM (#65614782)
    Read the linked article for details, Google is not just going to implement an app signing/notarization process, it's going to block the sideloading of unsigned/unnotarized applications entirely.

    For some context, Windows allows you to run unsigned apps if you bypass the scary warning and MacOS allows you to run unnotarized apps if you change some OS settings. But Google is going full iOS: No sideloading of unsigned/unnotarized apps at all. Android as delivered to most users (with GMS) is a closed platform now.

    • Well, shit. I'm going to have to get an alternative phone I guess.

      All affected users should sue Google in small claims court for bait and switch for the apps they sold through their app store. Almost certain to fail, but at least it will cost them money, the scum.

      • Yes, I also feel bait and switched, I've been an Android user since the LG Optimus 2X and I started building my Play Store library pretty much immediately. One of the reasons I chose Android over iOS was the fact you could sideload things like emulators (even emulators Google disapproves of such as psx4droid).

        I also hope some kind of legal action is taken against Google, but I wouldn't bet on it.

        BTW what is this "alternative phone" going to be? Lots of apps that you need to navigate modern life nowada

        • I'm ok without those apps, not excited but I don't use them anyway. (I have used Uber about three times, but not in literally years.) My employer issued me a phone because they are not stupid enough to embrace the security nightmare that is BYOD, so my authenticator has a place to run.

          I don't pretend it won't be inconvenient, but this is unacceptable.

          • BYOD was mostly an employee demand so employees don't have to carry two phones to work. It shows how much people are willing to give up to not carry two phones (even allowing their employer into their personal phone). Even myself, I wouldn't entertain a second personal phone just to avoid Android. I consider Android (with GMS) an essential like electricity now. And yet, it's fully controlled by a private company.

            • BYOD was mostly an employee demand so employees don't have to carry two phones to work.

              I don't know if that's true or not, but if so, those people are stupid.

              In my case I carry a whole-ass laptop bag to work (we bring our machines back in to the office for our in-office days) and the phone can fit in it without trouble.

              Meanwhile, you are as you say allowing your employer into your phone. Mine has made it clear that if I use my phone for work stuff, I may have to hand the phone over in the case of an investigation into things that happen at work. Therefore I don't use it for that. Even if I'm

        • I mean, you can technically live without apps such Deliveroo, Uber, Whats App, Viber, and the like, but you probably don't want to.

          You sure can. I do. I never even heard of some of those apps.

          • In some countries, Deliveroo and Uber Eats are essential because restaurants are phasing out their first-party delivery options and outsource delivery to Deliveroo or Uber Eats. Similarly, Uber and similar services are essential because taxis are absurdly expensive. And Whats App and Viber are what everyone uses, nobody uses iMessage outside the US and Canada and nobody likes using SMS.

            • Some of us just go pick up food from the restaurant ourselves. I own a car, I don't need someone else to bring me food in their car and maybe eat some of my fries, and charge me for the privilege.

              I might miss the Uber app if I traveled to some city where I wasn't driving around, I guess, but I really never do that. The last time I used Uber was when I went to a beer festival about five years ago.

              I'm sure some disabled people would miss those apps a lot, but it wouldn't affect me at this point.

              I have never u

    • For some context, Windows allows you to run unsigned apps if you bypass the scary warning and MacOS allows you to run unnotarized apps if you change some OS settings.

      For now.

      At least the saving grace with x86 hardware though, is that it's still open enough that you can say "fuck Microsoft" and run Linux instead, if that day comes.

      • Re: (Score:2)

        by tepples ( 727027 )

        At least the saving grace with x86 hardware though, is that it's still open enough that you can say "fuck Microsoft" and run Linux instead, if that day comes.

        Unless the cable and fiber ISPs for your area require a dialer application that is exclusive to macOS, iOS, genuine Windows, and certified Android.

        • I don't know if you are trying to be funny, but modern routers don't require "dialer applications", you connect to a LAN or WLAN.

          • Re: (Score:2)

            by tepples ( 727027 )

            I was using the term "dialer" to refer to a native application that responds to a challenge issued by a network access control server on a LAN or WLAN. When the user connects to the ISP through a LAN or WLAN, the user's machine is initially quarantined behind a captive portal offering only downloads of the dialer for Windows and macOS. The dialer then assesses the device, ostensibly to ensure that an antivirus approved by the ISP is running, and relays this information to a server that grants access to the

            • A "Connect App" perhaps? Anyway, no ISP does this because they'd have to support a bewildering number of OSes (including the OSes of future game consoles that don't exist yet), captive portals are such a widely-used thing for a reason (despite the whole idea of a captive portal being a gross hack).

    • This doesn't seem problematic to me.

      Even if you can only side-load signed apps, at least the app developer doesn't have to pay Google's high commission rates. Isn't that what side loading is really about?

      • Isn't that what side loading is really about?

        No, another major benefit of sideloading is developer anonymity, since sideloading can be used to install self-signed apks. This is going away now, soon you'll have to submit your apk to Google along with real ID information so your apk is Google-signed (euphemistically called "remotely self-signed"). This will be an issue for developers writing apps such as YouTube Downloaders, since Google could go after them (they already have done so in the past), and develo

        • Perhaps some developers want anonymity. But the vast majority want to be known for their work, especially those who want to sell software. Also, prudent users prefer to know who the developer is, because secretive developers tend to produce malware. Installing unsigned apps, is like buying a Rolex on the street. It's a very risky thing to do.

          No, I don't think developer anonymity is an important benefit of side loading, at least, not for users or for reputable developers.

          • And you don't understand that laws such as the DMCA's "anti-circumvention provisions" (and-similar laws in other countries) make certain kinds of software illegal (from software that unlocks DRM-encrypted music files to software that can run encrypted Nintendo Switch game images), so the "I have nothing to hide" rhetoric doesn't apply when the law makes your work illegal.

            • By definition such software titles are breaking the law (whether we agree with the law or not). I don't have a lot of sympathy for developers who want to install illegal software. Your suggested use cases certainly don't justify the outrage.

              • And what you don't understand is that the DMCA's "anti-circumvention provisions" don't apply outside the US and not all countries have similar laws. What Google is doing (by forcing you to have your apk uploaded and signed in a specific country) is forcing every Android developer under US jurisdiction. Considering the increasing political division in the US, are you sure this is not a problem?

                • I'm sure you haven't demonstrated that it's a problem. Unsigned APKs, or Windows executables for that matter, are most definitely a problem. Even most major open source software is signed, for good reason. If it's not signed, then you have no confidence that the binary came from who you think it came from, and could easily have been altered in ways you wouldn't want.

                  • I should have a developer option to take the risk and allow unsigned apps if I want to, precisely due to the dumpster fire that is US laws (all major OS vendors are headquartered in the US). See how MacOS is doing it.

  • When Google and Apple were just forced to stop forcing the Appstores on users (and make sideloading less scary in the case of Google) I think such a decision is quite a provocation. And I bet there will be many privacy advocates trying to get the EU to sue against that.

    • The EU has no problem with App Stores being the default or even sole mode of distribution (aka no sideloading), as long as third-party App Stores are allowed and the OS vendor's first-party App Store isn't a monopoly, the OS vendor won't run afoul of the DMA.

      • Re: (Score:2)

        by allo ( 1728082 )

        But the point of TFA is, that Google wants to limit sideloading. Alternative Appstores use sideloading mechanisms, independent developers may even want to distribute APK files. If you prevent that, you give the Appstore again a monopoly that gets the EU's attention.

        • Alternative App Stores don't necessarily have to be installed with sideloading. Sure, it's the best and most independent way of doing it, but another method is for the OS vendor to provide a "choose your App Stores" setting (kind of like the Windows Browser Ballot screen, but you can choose multiple options) or simply allow the installation of third-party App Stores from the first-party App Store as apps. Again, the DMA sees no problem with that (aka the OS vendor being an essential middleman to third-party

          • Re: (Score:2)

            by allo ( 1728082 )

            Yes, that could be implemented, but currently it is not. It can be that some Amazon Fire devices had both privileged Amazon Store and Google Store, but there is no simple API to do that. Also you may not limit who creates Appstores, so where is the point in limiting apps? If I can force you to allow my appstore, I can create a boilerplate appstore for a single app, if I have to do that.

            • I can barely understand your comment, but anyway, not having open sideloading and instead forcing third-party app stores to be an app that is delivered through the first-party app store gives the OS vendor the ability to delist a given third-party app store whenever they want (for example if they stop paying the "Core Technology Fee").

  • I won't touch a device with Google services so doesn't really matter to me yet I find these excuses exceedingly lame. Everything is ALWAYS for your own security. The Google play store is an absolute cesspit of everything must be free malware.

    Personally I always use adb install to install apps on my phone. So much easier and faster than screwing around with tiny screens and on screen keyboards. Also not having to deal with automatic updates that randomly break shit intentionally or otherwise is priceless

    • Re: (Score:2)

      by AyesC ( 5893452 )

      I won't touch a device with Google services so doesn't really matter to me yet I find these excuses exceedingly lame. Everything is ALWAYS for your own security. The Google play store is an absolute cesspit of everything must be free malware.

      Personally I always use adb install to install apps on my phone. So much easier and faster than screwing around with tiny screens and on screen keyboards. Also not having to deal with automatic updates that randomly break shit intentionally or otherwise is priceless.

      How is ADB easier? Every Android device I've ever sideloaded on is as simple as opening the .apk file in a file browser, tapping install on the confirmation popup, and that's it.

  • So now more hardware to throw out (Score:3)

    by ukoda ( 537183 ) on Monday August 25, 2025 @04:30PM (#65615090) Homepage
    The Google Chromecast paired with SmartTube beta makes YouTube usable if you ignore the scary warnings and don't let Google protect you from the horrors of ad free viewing. With this change it sounds like my Chromecast dongles will be joining my old FireTV dongles in the eWaste bin.

    Just hope that one day that developer will do a version as an add on for Kodi on the RPi.

    This enshitification of Android mean I really need to put more effort into finding future phones and tablets that run Linux instead.

    • Well fuck this will also ruin Revanced - the APK patching system which relies on the ability to modify APKs and side load them on the phone. I've used Youtube without blocking ads before, it hurt. I suspect when this change happens I will be watching Youtube much less.

      • Re: (Score:2)

        by ukoda ( 537183 )
        I watched YouTube with ads back when the number of ads was reasonable, but now there is no metric by which the number of ads can be called reasonable, unless you work at YouTube. If I lose the ability to watch ad free I will simply stop watching, there are alternatives.

  • Not only should you have to prove identity, you should also be required to provide proof of adequate insurance against liability, errors & omissions, etc.

    • proof of adequate insurance

      So now you're advocating the addition of gambling into this?

      FYI: The purpose of Insurance is to fleece people with low risk, while avoiding high risk people entirely.

      I.e. The person takes out a bet against themselves that they won't need to claim a payout that month, and their reward for not doing so is paying a premium to a company skimming off the top that will try every legal trick in the book to avoid paying when the person does make a claim.

      This is bad enough, but like all other grifters, you wa

      • An insurers reputation as a company depends on their reputation for paying out claims, so it's in their best interest to pay. The exception is health insurance in the US, since the insurers are a cartel that's in bed with the other cartel: healthcare providers/monopolies (do you really think insurers pay retail price?). This isn't the case for home insurance or car insurance. Also, people want some peace of mind that a lifelong investment like a house won't go up in smoke (literally and figuratively).

      • I am all for gambling.

        As for the purpose of insurance, it's to protect those the insured fucks over one way or another.

        Imagine if software vendors were required to carry specific insurance for data breaches that pays $50K to each person whose data are released.

        They would certainly have a lot more encouragement to protect against such breaches, rather than taking the position of "too bad, so sad" like they do now.

        Can't get coverage? Too bad, so sad.

    • If I want to write an app for my phone and stick it on my phone (which I own) I should have to "prove identity" and "provide proof of adequate insurance against liability, errors & omissions, etc."????

      WTF?

      How long before I have to do the same for code I write and run on my PC???

      Do you believe in ANYTHING that even resembles freedom and liberty? What, pray tell, is the justification for this headlong plunge in the direction of totalitarianism where mega-corps in bed with big government can dictate what y

  • Apple was right to ban sideloading since it is a major source of malware per Google.
  • If anyone is dumb enough to think Google won't be sharing your home address publicly (like they already do with their main app store), then I got a bridge to sell you.

Slashdot Top Deals

"Never give in. Never give in. Never. Never. Never." -- Winston Churchill

Close