Google opens early access for developer verification, but keeps an “advanced” sideload option for experienced users

Google has begun inviting developers who distribute apps exclusively outside the Play Store to early access its new developer identity verification in the Android Developer Console. The verification program is intended to make it harder for bad actors to distribute malware by tying app distribution to real, verifiable developer identities.

Crucially, Google also revealed it will provide an “advanced flow” that allows experienced users to install unverified apps if they accept the risks. The company says this choice responds to developer and power‑user feedback while aiming to prevent scams that rely on tricking people into sideloading malicious software.

How the system will work (so far)

• Developer verification: Developers who want their apps to run on certified Android devices will need to verify their identity through the Developer Console. Verification is intended to raise the bar for mass malware distribution.
• Advanced flow for power users: Experienced users will be able to bypass verification to sideload unverified apps, but Google says the flow will include clear warnings and safeguards so users are less likely to be duped into unsafe installs.
• Timing: Google says the feature is early access now and will roll out more broadly in late 2026.

Why Google is doing this

Google points to social‑engineering attacks — particularly scams in which victims are pressured to sideload fake banking or security apps — as a major driver for the change. Verification raises the cost and friction for attackers who previously could spin up harmful apps quickly and anonymously.

Verification won’t eliminate risk entirely, but by linking distribution to real identities it makes large‑scale abuse harder and easier to trace.

Open questions and tradeoffs

• How Google will define and safely gate the “experienced user” advanced flow remains unclear; the company says it will share more details and collect feedback.
• Developers who rely on alternative distribution channels (e.g., regional app stores or direct enterprise installs) need clarity on how verification affects their workflows.
• Privacy and identity checks for developers will raise questions about what documentation is required and how that data is protected.

Google frames this as a balance between preserving user freedom to install apps and reducing large‑scale attacks that exploit sideloading. The early access invites and the promised advanced flow indicate Google is trying to keep flexibility while making sideloading significantly safer at scale.

For initial coverage and context, see reporting such as this article (opens in a new tab): Engadget.

Discussion: Do you trust Google’s approach — requiring developer verification but keeping an advanced sideload option — or does verification risk creating barriers for legitimate indie developers? What safeguards would you want in the advanced flow?