Sideloading is here to stay. Google Won’t Completely Block Installations After All
Google today announced a significant concession in response to sharp criticism from enthusiasts and independent developers, sparked by an earlier announcement about stricter restrictions on app installation. The company has confirmed it is building a new “advanced flow” that will “allow experienced users to accept the risks of installing software that isn’t verified.”
This move is a direct reaction to widespread concern from the user base that the new security measures would “effectively kill sideloading.”
Details of the New “Advanced Flow”
In a new blog post, Google clarifies that this “advanced flow” is intended for developers and power users who “have a higher risk tolerance and want the ability to download unverified apps.”
The company emphasizes that it is “designing this flow specifically to resist coercion,” a measure intended to ensure that “users aren’t tricked into bypassing these safety checks while under pressure from a scammer.”
The flow will include “clear warnings” to ensure that users “fully understand the risks involved” when installing apps from unverified developers. Ultimately, however, the choice will be left in the user’s hands. Google states that it is currently gathering early feedback on the feature’s design and will share more details in the coming months.
Background of the Controversy
This announcement is a direct response to the controversy from late August, when Google revealed that starting next year, Android would block users from installing apps made by unverified developers. That announcement triggered a harsh backlash from advanced users, who felt the new restrictions would destroy the open nature of the Android platform.
Prior to today’s announcement, the only known method that would allow the installation of apps from unverified developers was the use of ADB (Android Debug Bridge). While ADB is relatively simple for experienced users, the process is tedious. It was possible that tools like Shizuku could have enabled ADB app installation without the use of a PC, but it was unknown how long such methods would last. Today’s announcement confirms that users will not have to “resort to such hacky methods” to install the software of their choice.
Google’s Core Rationale: Security
In the blog post, Google reiterated its core reasoning for implementing the new developer verification requirements: safety and security. The company wants to protect users from scammers and fraudsters, who often use social engineering tactics to trick users into installing malicious software from outside of a trusted app store.
They cite a growing trend in Southeast Asia where attackers call victims claiming their bank accounts have been compromised. Victims are then directed to install a malicious “verification app” to secure their funds. The attackers then instruct victims to grant the malicious app notification access, which allows it to intercept two-factor authentication (2FA) codes and other sensitive information.
By requiring developers to verify their identities, Google believes it will make it more difficult for bad actors to spin up new malicious apps after their previous ones have been taken down. This is because bad actors will have to use a real identity before they’re allowed to distribute software, making it harder for them to scale their attacks. How effective this will be in practice remains to be seen, but the philosophy behind it seems sound.
Verification Rollout and Concessions for Hobbyists
In parallel with the “advanced flow” announcement, Google has invited developers who distribute apps exclusively outside of the Play Store to join the early access program for developer verification. These developers will be able to enroll in the Android Developer Console to verify their identity ahead of the verification requirements taking effect next year. Invites have been rolling out to these developers since November 3. Meanwhile, developers who distribute apps through the Play Store will receive invites to enroll starting November 25, 2025.
On the other hand, imposing verification requirements increases the barrier to entry for hobbyists and student developers. To solve this, Google will allow them to create a “special type of account with fewer verification requirements and that doesn’t have to pay the $25 USD registration fee.” However, this account type will only be able to distribute apps to a limited number of devices, so it can’t be used to publish apps on an app store. Google says it is still working on this account type and is using community input to help shape it, so things could change before the verification requirements go into effect.
