Google is easing up on Android’s new sideloading restrictions

Back in late August, Google announced a major change to Android that angered many enthusiasts and independent developers. Starting next year, Android will block users from installing apps made by unverified developers. The announcement spurred backlash from power users who felt that the new restrictions would effectively kill sideloading. Today, Google announced a major concession to appease these users. The company says it is building a new “advanced flow” that will allow “experienced users to accept the risks of installing software that isn’t verified.”

An easier way to install unverified apps…hopefully

In a blog post, Google says this new advanced flow is intended for developers and power users who “have a higher risk tolerance and want the ability to download unverified apps.” The company says it is “designing this flow specifically to resist coercion” to ensure that “users aren’t tricked into bypassing these safety checks while under pressure from scammer.” The flow will include “clear warnings” to ensure that users “fully understand the risks involved” with installing apps made by unverified developers, but ultimately, it puts the choice to do so in the user’s hands. Google says it is currently gathering early feedback on the design of this feature and will share more details in the coming months.

Although Google hasn’t shared what this new flow will actually look like, it’ll hopefully be easier than using ADB to install apps. Prior to this announcement, the only method we knew would allow you to install apps from unverified developers was to use ADB, which is simple but tedious for experienced users. Tools like Shizuku would have made ADB app installation possible without the use of a PC, but who knows how long such methods would last. Thus, I’m glad that users won’t have to resort to such hacky methods to install the software of their choice.

Google also announced today that it is inviting developers who distribute apps exclusively outside of the Play Store to join the early access program for developer verification. These developers will be able to enroll in the Android Developer Console to verify their identity ahead of the enforcement of the verification requirements next year. Invites have been rolling out to these developers since November 3. Meanwhile, developers who distribute apps through the Play Store will receive invites to enroll starting November 25, 2025.

Google’s justification for its new developer verification requirements

Lastly, Google’s blog post reiterated its reasoning for implementing these new developer verification requirements: safety and security. The company wants to protect users from scammers and fraudsters, who often use social engineering tactics to trick users into installing malicious software from outside of a trusted app store. It cites a growing trend in Southeast Asia of attackers calling victims claiming their bank accounts have been compromised, who in turn are directed to install a malicious “verification app” to secure their funds. The attackers then direct victims to grant the malicious app notification access, which alllows it to intercept two-factor authentication codes and other sensitive information.

Requiring developers to verify their identities will make it more difficult for bad actors to spin up new malicious apps after their previous ones have been taken down. This is because bad actors will have to use a real identity before they’re allowed to distribute software, making it harder for them to scale their attacks. How effective this will be in practice remains to be seen, but the philosophy behind it seems sound.

On the other hand, imposing verification requirements increases the barrier to entry for hobbyists and student developers, so Google will allow them to create a special type of account with fewer verification requirements and that doesn’t have to pay the $25 USD registration fee. However, this account type will only be able to distribute apps to a limited number of devices, so it can’t be used to publish apps on an app store. Google says it is still working on this account type and that it is using community input to help shape it, so things could change before the verification requirements go into effect.