After a period of speculation regarding the future of sideloading on Android devices, Google has officially clarified its stance. Mishaal Rahman, the Community Engagement Manager at Google, recently unveiled a new app installation framework known as “Advanced Flow.” The key takeaway from this announcement is that while sideloading will not be outright blocked, applications signed by developers who have not undergone identity verification will be intercepted during installation.
Understanding the New Framework
Under the new guidelines, the focus shifts from users to developers. Currently, Android devices support two main methods for app installation: users can either download apps directly from the built-in app store or manually install APK packages from third-party sources, the latter being referred to as sideloading. With the implementation of the new rules, users will still retain the ability to sideload apps, provided that the developer has completed the necessary real-name verification.
Google has acknowledged that its previous developer vetting processes were not stringent enough. Instances of developers registering under pseudonyms or creating multiple accounts under a single identity have led to vulnerabilities, allowing for black-market activities and malware distribution. To address these concerns, the new regulations will require developers to register with their real names. Any software signed by unverified developers will be flagged at the installation stage, prompting a warning message for users. Fortunately, most users will likely continue to encounter apps signed by verified developers, resulting in minimal disruption to their experience.
However, not all developers are pleased with these changes. The requirement for verified developer accounts comes with a registration fee, which can be a burden for those creating non-profit software. In response to this concern, Google has introduced a special application channel for free accounts aimed at hobbyists and educational projects. While these accounts still necessitate real-name verification, they waive the registration fee. Software signed under these accounts will have certain limitations, such as installation caps, and is intended for distribution within small communities.
Installation Workarounds for Users
For users who need to install software from unverified developers, Google has provided a detailed workaround. Users must first enable “Developer Options” on their devices and then toggle the setting for “Apps from unverified developers.” This process requires the user to enter their lock screen password to confirm device ownership and answer whether they are being coerced into enabling this option. If the user acknowledges the risks and proceeds, the device will automatically restart.
After the restart, a 24-hour waiting period is imposed before users can re-enter Developer Options to either permanently allow installations of unverified software or enable the toggle for a limited duration of seven days. Once this is completed, users can manually install unverified software, although the system will still display warnings during the installation process.
Two notable aspects of this process include a 10-minute grace period allowing users to re-enable the installation setting without waiting another 24 hours if they accidentally toggle it off, and the requirement for the toggle to remain active for first-time installations, reinstalls, and updates of unverified software. Google emphasizes this precaution to prevent malware that may hide during initial installations and inject malicious code through subsequent updates.
Global Rollout and Future Considerations
According to ExtremeTech, Google plans to enforce developer verification starting September 30 in Brazil, Indonesia, Singapore, and Thailand, with a broader global rollout anticipated by 2027. This initiative will encompass Google Play as well as select third-party app stores, including Galaxy Store and OPPO App Market, among others.
Interestingly, Google has not applied equivalent restrictions to app installations via ADB (Android Debug Bridge), which requires a connection to a computer and a certain level of technical expertise, typically appealing to developers and power users. The overarching goal of the Advanced Flow framework is to enhance user protection against scams and malware, particularly for vulnerable populations such as the elderly.
Despite these protective measures, some critics argue that the new framework may undermine Android’s traditional openness and create challenges for independent developers and power users. As Google implements these changes, the ongoing dialogue surrounding the balance between security and openness in the Android ecosystem is likely to continue.
Key Points of Android’s New Sideloading Rules
| Item | Details |
|---|---|
| Sideloading | Not blocked; users can still manually install APKs |
| Core requirement | Developers must complete real-name verification |
| Unverified software | Intercepted at installation; requires Developer Options bypass |
| Bypass waiting period | 24 hours after phone restart |
| Toggle validity | Permanent or 7-day option |
| Accidental toggle-off recovery | 10-minute window to re-enable without waiting again |
| Free verified accounts | For hobbyists and educational projects, with installation caps |
| First enforcement regions | Brazil, Indonesia, Singapore, Thailand (from September 30) |
Note: ADB installation is not subject to the above restrictions.
