Android's Verification Deadline Is September 30: Register Your Apps Now

If you ship an Android app anywhere other than Google Play, put September 30, 2026 in your calendar. From that date, apps have to be registered by a verified developer to be installed on certified Android devices in Brazil, Indonesia, Singapore and Thailand, and Google says the requirement goes global from 2027. Verification is two tasks: prove who you are, and register your package names against the key you sign with. It costs $25 for an account with unlimited distribution, or nothing at all if you accept a 20 device ceiling. If you already publish on Play using Play App Signing, most of it has already happened without you noticing. Below is the timeline, the account decision, and the four situations you are likely to be in.

The two things Google is actually asking for

Google's verification documentation (opened July 25, 2026) splits the requirement in half. First, verify your identity: legal name, address, email address and phone number, with a government ID upload possible. Organisations give a D-U-N-S number and verify the organisation's website instead. Second, register your package names: you prove you own an app by supplying an APK signed with your private key, which links the app to your developer account.

The second half is the part developers underestimate. Identity checks are a one-off. Package registration is per app, and it is tied to signing keys, which means every app you have ever published under a key you still control needs to be accounted for, including the abandoned one from 2019 that a few thousand people still have installed. Google says Android Studio will surface an app's registration status when you generate a signed App Bundle or APK, which turns the audit into something you can do at build time rather than from memory.

The dates Google has published

March 30, 2026: verification rolled out to all developers in both Play Console and the new Android Developer Console.
April 2026: users start seeing an Android Developer Verifier entry in their Google system services settings.
June 2026: early access to limited distribution accounts for students and hobbyists.
August 2026: limited distribution accounts and the advanced install flow launch globally.
September 30, 2026: enforcement begins. Apps must be registered by a verified developer to be installed and updated on certified devices in Brazil, Indonesia, Singapore and Thailand.
2027 and beyond: the requirement rolls out globally.

Those milestones come from Google's rollout announcement (opened July 25, 2026). The four country list is the whole enforcement scope for September; Google has not published which markets come next, only that global rollout follows in 2027. If your users are elsewhere, you have until an unannounced date rather than until never.

Which account: the $25 one or the free one

There are two tiers, and the deciding number is 20.

Limited distribution is free, needs only an email address, requires no government ID, and lets you distribute to up to 20 devices that end users have explicitly authorised. Google frames it for students, hobbyists and teachers. It is a genuine option for an internal tool, a family utility, a club app, or a side project with a handful of testers.

Full distribution costs $25 in registration fees and gives unlimited apps and installs. It requires the identity verification described above, and organisations need the D-U-N-S number. If you publish outside Play, this lives in the Android Developer Console.

The decision rule is unglamorous: if there is any chance the app reaches a 21st device, pay the $25 now. Twenty is not a soft target you grow past gracefully; it is a ceiling, and discovering it during a launch is a bad afternoon. The $25 is the same order of magnitude as the Play Console fee most Android developers already paid years ago, and it is trivially small next to the commission programmes that decide what you actually keep from a sale.

Four situations, four next steps

You publish on Play and use Play App Signing. Do nothing beyond a check. Google states that if you completed Play Console's verification, your identity is already verified, and eligible Play apps are registered for you automatically. Open Play Console, confirm the verification status on your account, and confirm that every app you care about is listed. The failure case here is an app signed with a key you manage yourself outside Play App Signing.

You publish on Play but sign your own releases. Identity is likely handled; package registration is not automatic. Gather every signing key you still ship with, then register each package name using a signed artifact. Do this before August, because the two months around the September date are when support queues fill.

You distribute outside Play: your own site, F-Droid, Amazon, an enterprise channel. Create an Android Developer Console account now. Google's FAQ notes that if you distribute through stores that are not on the initial September 2026 list, the requirement is not enforced during that first phase, and then recommends preparing anyway before the 2027 global rollout. That is a polite way of saying the grace period has an expiry date nobody has told you.

You are a hobbyist or teacher with a small install base. Take the free limited distribution account, then count your actual installs honestly. Twenty authorised devices covers a classroom set or a small beta. It does not cover a moderately successful GitHub release.

What verification does not do

A rumour cycle has grown around this, so it is worth being precise about what Google's own FAQ says (opened July 25, 2026).

It does not end sideloading. Verified developers keep distributing directly to users or through any app store they choose, with no change to the install experience.
It does not affect ADB. Developers can install and test via ADB without verification, and the waiting period described below does not apply to ADB installs. This matters because today's most discussed Android thread is a feature request on Google's issue tracker in which a maintainer floated restricting the ADB daemon to the wlan0 interface after a CVE. That is a discussion on a bug tracker, not shipped policy, and the author of that post says plainly that any link to sideloading policy is his own speculation. Treat it as a thing to watch, not a thing to plan around.
It does not block installs from unverified developers outright. Google is shipping an advanced flow: the user enables developer mode, confirms they are not being coached through the process, restarts and reauthenticates, waits 24 hours, then confirms with biometrics or a PIN, and can enable the permission for 7 days or indefinitely. A warning still appears with an Install Anyway option. That 24 hour delay is aimed at scam callers walking victims through an install in real time.
It is not enforced everywhere. Devices in sanctioned countries will not have verification checks enforced, which also means users there do not get the protection.

Google's stated justification is a malware ratio: its analysis found over 90 times more malware from sideloaded sources than on Google Play. That number is Google's own, published without an accompanying methodology, so read it as the argument for the policy rather than as an independently checked statistic.

The part that is really about you

Verification converts a permissionless distribution channel into a registered one. Your app now has a named, ID-checked party behind it and a package name filed against a signing key. The practical exposure is not the $25 or the paperwork; it is that a second lever now exists which can be pulled against your distribution, in the same family as app review decisions. Anyone whose revenue depends on a single install path should run the exercise in our platform dependency audit against this one specifically: if your developer account were suspended tomorrow, how many of your users could still install and update?

Three tasks, this week, in order: open Play Console or the Android Developer Console and check your verification status; list every signing key you still ship with and confirm each package is registered; decide whether 20 devices is a ceiling you will hit, and if the honest answer is maybe, pay the $25 before August, when the queues get long.