In August 2025 Google announced that, starting in 2027, every Android app developer has to register centrally with Google before their software can be installed on a certified Android device. Registration means paying a fee ($25), accepting Google's terms, handing over a government-issued ID, providing evidence of your private app-signing key, and listing every application identifier you ship now and intend to ship later. The requirement does not stop at the Play Store. It covers apps distributed through F-Droid, apps passed directly between people, and builds that a hobbyist makes for personal use. A developer who does not register has their apps blocked on Android devices worldwide. The keepandroidopen.org campaign organizing the opposition is counting down to the first enforcement, which it puts roughly 70 days out.
What the check actually verifies
Google is verifying the developer rather than the code. Registration binds a legal identity to a signing key and a declared set of package names. Google already runs Play Protect, which scans app binaries for malware regardless of who signed them, so the new program adds an identity axis on top of the existing code-scanning one.
That is where the stated security rationale gets thin. Knowing who wrote an app does not tell you whether the app is safe. Cory Doctorow (Pluralistic) makes the point that certifying developers rather than code assumes Google can predict whether someone will later ship something malicious. Maya Posch (Hackaday) notes the operational gap: identity checks do nothing against the common practice of scammers buying up existing verified developer accounts. F-Droid points out that Google Play has repeatedly hosted malware under its own gatekeeping.
The fallback flow runs through Play Services, not the OS
The detail that matters most if you reason about trust boundaries: the fallback install flow runs through Google Play Services, a proprietary component, not through AOSP. Google can change, tighten, or remove it without shipping an OS update and without the device owner's involvement. The policy applies retroactively to hardware already sold.
Google points users who want to install an unverified app to an "advanced flow." It runs to nine steps: enable Developer Mode by tapping the build number seven times, dismiss warning screens, enter your PIN, restart, wait a mandatory 24 hours, return, dismiss more warnings, then choose to allow the install for 7 days or indefinitely. Google describes this as making sideloading "high-friction" to better warn users about risk (XDA). For planning purposes, treat that flow as unavailable to non-technical users.
Rollout and regulatory context
Google is starting the program in Brazil, Indonesia, Singapore and Thailand rather than the US or EU.
The timing tracks Google's antitrust losses. Doctorow reads the change as malicious compliance with the court orders from the Epic Games case. Aptoide has filed a fresh lawsuit alleging monopoly and anticompetitive conduct. In the EU, MEP Christel Schaldemose has formally asked whether mandatory central registration is compatible with the Digital Markets Act, the same law that has been pushing Apple in the other direction.
Opposition is organized. F-Droid calls the change existential, says it would end the project, and advises developers never to sign up. An open letter has drawn 71 organizations from 23 countries. Brave, Nextcloud, KDE, the EFF and the Free Software Foundation have each published objections. A change.org petition has passed 100,000 signatures.
What this means if you ship Android software
If you distribute outside the Play Store, your distribution now depends on Google holding a record that maps your legal identity to your signing key and your package IDs. For teams shipping internal betas or enterprise tooling, that is a new external dependency to account for. For anyone building privacy software (VPNs, encrypted messengers, Tor-based tools), the concern Brave raised is direct: the people most likely to distrust Google are now required to upload ID to Google to keep shipping. Developers in sanctioned countries or without Play access cannot verify at all, which, as Termux's maintainer puts it, gates distribution on birthplace rather than conduct.
Two parts of the registration are the awkward ones to live with. Listing all future application identifiers means registering package names before anything exists under them. Providing evidence of your private signing key means handing that proof to a company with a documented record of complying with government takedown demands.
F-Droid's own guidance, worth knowing even if you disagree with it, is that developers should not sign up "now or ever."
Top comments (0)