Android Sideloading After September 30, 2026: What Changed

Android did not ban sideloading on September 30, 2026. That day, Google started enforcing developer verification for installs from seven app stores, on certified devices in Brazil, Indonesia, Singapore and Thailand. Google's own FAQ says APKs that people install directly are not affected yet. The change that reaches sideloaded apps is the global rollout Google plans for 2027, and the time to prepare for it is now.

What started on September 30

Sources: Google's developer verification guide and FAQ, checked October 2, 2026. The guide describes the requirement as applying whatever the download source; the FAQ answers the September 30 question directly: “if users sideload your app directly, these new verification requirements won't apply to your app yet.”

If you share APKs directly

Nothing changes for your users this year. Before the global rollout, prepare three things, because registration ties your app to its signing key:

1. Sign with a key you own and keep. A package is registered with the certificate of its signing key, and Google says a lost key means you cannot register your packages. Back up the keystore and its passwords now.
2. Verify your identity in the Android Developer Console. Students and hobbyists can use a limited-distribution account instead, which Google describes as sharing apps with up to 20 devices without a government ID, at no cost.
3. Register each package name. If the name is already in use by someone else, Google may ask you to pick another one or send the claim to review, so check early.

People who install an unregistered app will still be able to use Android's advanced flow: a one-time setup with a one-day wait and a confirmation, after which installs show a warning. That is a hurdle most customers will not clear, so plan to register.

If you publish on Google Play

Google says apps that use Play App Signing are registered automatically when they are eligible. Check each app's registration status in Play Console, and keep your upload key: Play still requires it for every update.

Apps built with Code2Native

Which key signs your app decides whether you can register it. Source builds are signed with a key created for your project, or with a keystore you uploaded; you can register that certificate. Website apps built with your own keystore can be registered too, through support for now. Website apps and Preview APKs signed with our shared platform key cannot be registered by their owner, because many apps share that key. Our developer verification guide lists which key signs each kind of build and how to add the registration file.