Installing APKs on Android has historically been one of the system's defining features. In contrast to iOS's closed model, allowing users to download an APK file from a website and install it themselves has been a highly valued freedom. This is changing: Google has launched a developer verification system that adds new barriers to sideloading and has already begun to be implemented in several countries.
The first phase was activated on September 30 in Brazil, Indonesia, Singapore, and Thailand. However, the launch hasn't been as impactful as expected: the company has scaled back the initial scope and limited its control to apps distributed through a specific list of app stores. Spain is not among the markets included in this first wave, so Spanish users, for now, won't notice the change in their daily lives.
What changes with developer verification
The new program links each application's package name and signature key to the developer's identity. For an app to be registered, the creator must verify their identity and prove control of the APK using a private key. If the developer is not verified and the app is not from an authorized store, the system blocks standard installation.
Google justifies this measure on security grounds. According to their analysis, apps installed outside of Google Play are more likely to contain malware than those distributed through the official store. The idea is to curb the anonymity of malicious actors who publish modified APKs. Even so, the community fears that the measure will also affect legitimate projects and that installing APKs will become a cumbersome process.
The initial rollout has caused confusion. Although there was talk of a general block on third-party APKs, the verification currently only applies to apps from seven participating app stores. Direct downloads from websites are excluded from this phase , as are installations via ADB or from stores not on the list. However, Google is sticking to its roadmap: global expansion is planned for 2027.
Authorized stores and initial scope
The seven stores included in the program are Google Play, Samsung Galaxy Store, Xiaomi GetApps, HONOR App Market, OPPO App Market, vivo V-Appstore, and Transsion Palm Store. If an app is distributed through one of these channels and its developer is registered, the installation process remains the same. The user should not encounter any additional steps.
The initial rollout is limited to devices certified with Android 7 or later, and affects phones and tablets in the four pilot countries. Spain is not among them , nor is the rest of Europe. The measure also does not yet apply to APKs downloaded directly from a website, nor to app stores not included in the pilot program. For this reason, many users have felt that the rollout has started slowly.
The list of authorized channels is not arbitrary. Google wants manufacturer stores to maintain their own review processes and for verification not to depend solely on the Play Store. The company has reiterated that it does not intend to eliminate sideloading entirely , but rather to add layers of control to reduce the risk of malware.
The advanced flow for installing unverified APKs
When the restriction is actually applied to an unverified APK, the user will have to go through a much longer procedure than the current one. First, they will need to enable developer options and check the box for unverified apps. Then, the system will display a warning to confirm that no one is pressuring the user. Afterward, it will be necessary to restart the phone and wait 24 hours.
Once that period has elapsed, the application can be installed using a fingerprint or PIN. At that point, the user can choose whether to grant a temporary seven-day permission or keep it indefinitely. ADB, the USB debugging tool, continues to function unchanged and allows APK files to be installed on PCs and devices without requiring a restart or waiting a day. For many advanced users, this remains the most practical method.
The community has also explored other alternatives, such as using tools that leverage on-debugging or root access. Rooted devices and Android ROMs without Google services can circumvent some of these barriers , but they are not recommended options for the average user. Therefore, this measure does not represent a complete shutdown, although it does add friction.
Impact on F-Droid, GitHub, and modified applications
One of the most discussed side effects is the impact on open-source software repositories. Projects hosted on GitHub or distributed by F-Droid can be negatively affected because modifying an APK changes its signature. Android can categorize that file as unverified , even if it's a legitimate application audited by the community. This jeopardizes the viability of many open-source tools.
F-Droid is one of the names most frequently mentioned in this debate. The community fears that the verification process will exclude legitimate applications not available in authorized app stores. When an APK is updated or modified, the signature changes, and the system may treat it as unverified. This doesn't mean F-Droid will stop working overnight , but it does add uncertainty to the free software and independent developers.
In Europe, the Digital Markets Act has encouraged the use of alternative stores and third-party payment methods. However, Google's policies add requirements that may conflict with this philosophy. For free software advocates, the balance between security and openness is increasingly delicate. It's not just about preventing malware, but also about ensuring that legitimate alternatives aren't stifled by measures designed for malicious actors.
What users can do and what is expected by 2027
For those who regularly install APKs, the advice is to remain calm: in Spain and most of Europe, the first phase remains unchanged. Direct downloads and non-participating app stores continue to function as before . However, it's advisable to keep an eye on Google updates and changes in manufacturer app stores, as the program will be expanded.
Google plans to extend verification protections globally by 2027. While no specific month or date has been set, the intention is for all certified Android phones to eventually comply with these rules. The expiration date for the classic installer is approaching , and this will affect both users and independent developers.
Meanwhile, alternative methods like ADB will remain a lifeline for many. There will also be those who choose not to update or to use devices with custom ROMs. APK installation isn't going away, but it's no longer a simple switch; it's becoming a more complex process with more controls.
The landscape of APK installation on Android is undergoing a major transformation. Google has begun requiring developer verification in four pilot countries, although for now the measure is limited to seven app stores and excludes direct downloads and Spain. The advanced process, involving a restart and a 24-hour wait, will be implemented when the block reaches unverified APKs, while ADB and other technical methods remain open. The planned global rollout by 2027 and the impact on F-Droid, GitHub, and open-source software are fueling a debate that blends security, control, and freedom within the Android ecosystem.
