Android Sideloading in 2026:
What the 24-Hour Wait
Actually Blocks
TL;DR: Google has begun rolling out the advanced flow, a new Android sideloading process that puts a reboot and a one-time 24-hour wait between you and any app whose developer has not registered identity documents with Google.
Verification enforcement starts on 30 September 2026 in Brazil, Indonesia, Singapore and Thailand, then goes global across certified Android devices in 2027. The check runs in a Play Services component called Android Developer Verifier, so pure AOSP builds and de-Googled systems are not affected. ADB installs are exempt too.
If you use F-Droid on a normal phone, this is the year that stops being frictionless. If you already run GrapheneOS or LineageOS, nothing about your install path changes.
Jump to
What is the Android sideloading advanced flow?
Six steps, one reboot, and a full day of waiting. That is Android sideloading in its new form.
That is what now sits between a certified Android phone and an APK whose developer has not registered with Google. The Android team announced the rollout on 18 August 2026 and called it the first version, so the shape of it may still move. It arrives gradually rather than in one push, so your phone may not have it yet.
Here is the sequence, as Google describes it.
- Open Developer Options and select Apps from unverified developers.
- Turn on Allow apps from unverified developers.
- Authenticate with your screen lock.
- Confirm that nobody is pressuring you into changing the setting.
- Restart the phone, then wait 24 hours.
- Go back to the setting and pick seven days or indefinitely.
Only then can you install, and you still get a warning screen with an Install anyway button behind it. Getting Developer Options open in the first place means tapping the build number seven times. Most people have never done that and will not find it on their own.
The wait is one-time rather than per-app. Once you are through it, Android sideloading behaves roughly as it used to until the permission expires or you switch it off.
Six details that got buried in the coverage
Most write-ups stopped at the 24-hour wait. The rollout post answered several questions that matter more in daily use.
Developer Options can go back off afterwards. You do not have to leave the menu enabled once the flow is complete. That is a genuine relief for anyone whose banking or payment apps refuse to run while developer mode is active, and it was the single loudest worry in the March discussion.
It applies to updates, not just fresh installs. Switch the permission off and updates to apps from unregistered developers will fail. Your installed apps keep running. They just stop moving forward.
There is a ten-minute grace period. If you toggle the flow off and change your mind quickly, you can turn it back on without triggering another full day of waiting. Ten minutes is not long, and nothing suggests it is configurable.
The status transfers to a new phone. Google’s product team has confirmed that completing the flow on one device carries across during setup on the next one. What happens after a factory reset, or after flashing a different OS, has not been spelled out anywhere I can find it.
Apps cannot detect it. The setting is an OS-level change, so an app cannot check whether you have enabled the flow and refuse to run. Compare that with root detection, which apps absolutely do check for.
You can pull the component forward. The flow depends on a system service called Android Developer Verifier, and Google says you can install it manually from Google Play to get access sooner. Hold that thought. It matters more than it looks, and I come back to it below.
When does Android developer verification start, and where?
Enforcement begins on 30 September 2026 in four countries: Brazil, Indonesia, Singapore and Thailand. Global rollout across all certified Android devices follows in 2027.
| When | What happens | Where |
|---|---|---|
| Aug 2026 | Advanced flow starts rolling out gradually. First version, per Google. | Certified devices, staged. |
| 30 Sep 2026 | Verification enforced. Unregistered developers’ apps blocked from install and update. | Brazil, Indonesia, Singapore, Thailand. |
| 2027 | Enforcement expands to all regions and all app installations. | All certified Android devices. |
Swipe the table sideways to see every column.
The first phase covers seven storefronts rather than every install route: Google Play, the Samsung Galaxy Store, HONOR App Market, OPPO App Market, Xiaomi GetApps, Palm Store and Vivo’s V-Appstore. Direct APK installs come into scope with the wider 2027 expansion.
Certified means a device that ships with the Play Store and Google Play Services preloaded. That covers the vast bulk of Android phones sold outside China. F-Droid’s own open letter puts the figure above 95%.
What does a developer have to hand over?
A legal name, a physical address, an email address, a phone number, a government-issued photo ID, the app’s package name, its signing keys, and a one-time $25 registration fee. Organisations add a D-U-N-S number from Dun and Bradstreet. That part is free, but it can take up to 30 business days.
Developers who already hold a Play Console account can register non-Play apps there. Everyone else uses the new Android Developer Console.
Google did build an exit. The Limited Distribution account waives the fee and the government ID, and lets a developer distribute an unlimited number of apps. To a maximum of 20 devices.
Why the free tier does not solve the open-source problem. Twenty devices is a family, a classroom, or a beta group. It is not a distribution channel. An F-Droid app with 40,000 users cannot be served by an account capped at 20 handsets, so the tier that skips the ID check is exactly the tier that cannot be used for public releases.
Google’s framing throughout has been an airport ID check. Confirming who the traveller is, separately from screening their bags. The company has been consistent that verification identifies the developer and does not review the app.
Where does the check actually run?
In a system service called Android Developer Verifier. It ships through Google Play rather than being baked into the Android Open Source Project.
That is a documented fact, not a reading between lines. Google’s own rollout post tells users they can install the component manually from the Play Store to receive the advanced flow sooner. A thing you can install from a shop is a thing that ships on its own schedule.
My analysis, flagged as such. The verifier lives in the Play Services layer. That means the rules it applies can be revised without an Android release. Waiting periods, warning copy, the list of what counts as verified: all of it sits above the operating system rather than inside it.
Google has not published a policy on changing those settings. I am reading that off where the code sits, not off a stated plan.
The corollary is the useful bit. No Play Services, no verifier, no enforcement. A device running pure AOSP or a de-Googled distribution has nothing on it to perform the check.
Android stays open in the licence. The gate moved to a component the licence does not cover.
Why F-Droid says this could end it
Because F-Droid signs most of its catalogue with F-Droid’s key, and Google’s system ties a package name to the original developer’s registered identity and their key.
F-Droid pulls source from public repositories, compiles it on its own build servers, and signs the result. That model exists so users do not have to trust a binary they cannot inspect. Under verification, a binary signed by F-Droid for a package registered to someone else is a mismatch, and a mismatch does not install.
There is a partial escape. Where a build is reproducible, F-Droid can publish the upstream developer’s own signed binary after confirming it matches the source. That path works. It needs the upstream developer to have registered with Google. Which brings us to the second problem.
Plenty of F-Droid maintainers publish under a pseudonym on purpose. Some are avoiding an employer, some a government, some an ex-partner. Asking them to send a passport scan to Google is not a paperwork inconvenience, and a number of them have already said publicly that their apps will simply stop working on certified devices. The Kotatsu project ended development citing pressure from this and other directions.
Then there are the abandoned ones. An app whose maintainer vanished in 2019 has nobody left to register it.
On the 85% figure. You will see a claim that 85% of F-Droid’s catalogue ends up stuck. That number comes from estimates going round the F-Droid and Android forums, not from a published package-by-package count. It is plausible and it is widely repeated. It is not measured, and BAIZAAR is not going to print it as though it were.
One clarification from Google’s community manager is worth carrying forward, because it removes a common misreading. It does not matter where the APK came from. F-Droid, Obtainium, a GitHub release page, a colleague’s USB stick: the only question the system asks is whether the developer behind it is registered.
Does the security argument hold up?
Partly, and it fails precisely where Google’s own justification for the strictest part of the policy points.
Start with what the policy does well. Tying a name to a package raises the cost of the throwaway-account cycle, where a banned developer opens a new Gmail address and re-publishes within the hour. That cycle is real, it is cheap, and ID checks do genuine damage to it.
Google also cites internal figures putting malware rates from sideloaded sources far above Play Store rates. Those are Google’s own numbers. Unaudited, and published by the side making the argument.
Google’s record on describing its own privacy behaviour is not spotless either. The Google Incognito lawsuit ended with the company rewriting what Chrome told people rather than changing what Chrome did.
Now the hole.
When users asked why updates to already-installed unverified apps should be blocked, Google’s community manager answered that an app installed before verification could later receive a malicious update. That is a fair description of a real attack. Security researchers call it versioning, and it is the standard method for getting malware past app store review.
The canonical case is iRecorder, a screen recorder that sat on the Play Store behaving perfectly for eleven months before an update added code that recorded from the microphone every fifteen minutes and shipped the audio to a remote server. It was a verified developer the entire time. Verification did not stop it, because verification does not read the code.
The pattern keeps repeating on the verified side of the wall. Zscaler’s ThreatLabz team found 77 malicious apps on Google Play with more than 19 million installs between them, including the Anatsa banking trojan. HUMAN’s Satori researchers documented an ad-fraud operation they named SlopAds running across 224 Play Store apps with roughly 38 million downloads. Every one of those developers had passed the identity check.
So the argument Google uses to justify blocking F-Droid updates describes an attack that works fine against registered developers, and the friction lands on the software least likely to carry the payload. Whether that trade is worth making is a judgement call. Whether it is being described accurately is not.
Android Authority polled its readership after the March announcement. Of more than 7,300 respondents, 79% either felt the rules damaged Android’s openness or understood the reasoning and called the approach excessive. A later poll on whether the flow would meaningfully reduce scams ran 84% against, out of 5,289 votes. Self-selecting audience, obviously. Still a number Google has seen.
Android sideloading routes that still work, and what each costs you
Two Android sideloading routes skip the advanced flow: installing over ADB, and running an Android build with no Google Play Services on it.
| Route | What it takes | What you give up |
|---|---|---|
| Advanced flow | Seven taps, a reboot, 24 hours, then a 7-day or indefinite permission. | A day, on first setup. Nothing after that until it expires. |
| ADB install | A computer, USB debugging, platform-tools, and adb install app.apk. | Portability. You need the PC every time you install or update. |
| De-Googled OS | Supported hardware, bootloader access, a careful flash. | Some banking and payment apps. Possibly your warranty position. |
Swipe the table sideways to see every column.
ADB is confirmed exempt from both the 24-hour delay and the verification check. It is also a terminal on a laptop. That rules it out as a way of reaching anyone’s parents. As a personal workflow it is fine. As an answer to the question of how open-source Android software reaches ordinary users, it is not an answer at all.
The de-Googled route is the durable one. GrapheneOS, LineageOS, CalyxOS and /e/OS all ship without Play Services, so the verifier is not present to enforce anything.
GrapheneOS runs on recent Pixel hardware only. It uses the secure element to re-lock the bootloader under its own keys, and that detail is what keeps verified boot intact after flashing. LineageOS covers a far wider device list and generally does not.
Hardening cuts both ways, mind. GrapheneOS is also the OS whose duress password put an Atlanta man in front of a federal judge, a story we went through in the GrapheneOS duress password case. Choosing a phone that resists Google is not the same as choosing a quiet life.
Worth noticing who survives this comfortably. Proton distributes its Android VPN app through F-Droid and as a GitHub APK, precisely the routes this policy touches. Proton AG is a registered Swiss company, so it will clear verification without breaking stride. The maintainer working alone under a handle will not. That asymmetry is the whole policy in one sentence, and our Proton VPN review covers what the app itself is worth.
European hardware vendors sell this configuration ready-made. Fairphone ships /e/OS, Volla runs VollaOS and Ubuntu Touch, SHIFTphone has ShiftOS-L, and Punkt uses Apostrophy OS. Prices and availability move, so check before you commit.
Sandboxed Play Services complicates this a little. GrapheneOS can run Google Play in a sandbox for app compatibility, and whether that arrangement pulls the verifier along with it has not been publicly settled. If you depend on sandboxed Play, check the GrapheneOS release notes rather than trusting this paragraph in six months.
Are regulators going to stop this?
Nobody has blocked developer verification, and as of late August 2026 no competition authority has opened a formal investigation into the policy specifically.
There is movement around it. On 2 July 2026 the Court of Justice of the European Union gave its final ruling in the long-running Google Android antitrust case, threw out Google’s appeal and made the penalty final.
The Commission has also opened Digital Markets Act proceedings on Android interoperability on 27 January 2026 and issued draft findings in April. A written question tabled in the European Parliament asked the Commission whether developer verification meets the DMA at all.
The UK’s Competition and Markets Authority has Google’s mobile platform under a Strategic Market Status investigation. It has not published a position on verification.
On the campaigning side, Keep Android Open has gathered more than 37 organisations, including the Electronic Frontier Foundation, the Free Software Foundation Europe, F-Droid, Article 19, Fastmail and Vivaldi. Their argument is that a mandatory identity gate operated by one company is incompatible with the DMA rule that gatekeepers must allow third-party software to be installed.
Regulatory timelines run in years. September is next month.
What this page cannot tell you
Honest gaps in the record as of 30 August 2026:
- Google calls this the first version of the Android sideloading flow. Steps, timings and warning screens can change before September, and probably will.
- What happens to your completed advanced-flow status after a factory reset, or after flashing a different OS, has not been set out.
- Whether sandboxed Play Services on GrapheneOS brings the verifier with it is unconfirmed.
- Google’s sideloading malware multiplier is an internal figure, published by Google, with no external audit attached.
- The 85% F-Droid catalogue figure is a community estimate, not a count.
- No enforcement has happened yet. Everything about 30 September is announced policy, not observed behaviour.
- How offline and kiosk devices handle a verification check that expects connectivity has been raised repeatedly and not answered.
Should you move off certified Android now, or wait?
Wait, unless you are in one of the four enforcement countries or your daily routine depends on unregistered software.
If you are in Brazil, Indonesia, Singapore or Thailand: you have weeks, not months. Audit what you have installed from outside the Play Store, work out which of those developers are likely to register, and get the advanced flow completed before you need it rather than during an emergency.
If you are anywhere else and use F-Droid casually: do nothing yet. You have until 2027, the policy is still moving, and the flow is a one-time day of waiting rather than a permanent block. Buying a phone in a hurry is how people end up with hardware they resent.
If your threat model actually requires unregistered software: journalists, researchers, people using pseudonymous tools because being identified carries a real cost. Start planning the migration now. Not because September affects you, but because a supported device, bootloader access and a banking setup that works take months to line up properly.
Whichever group you fall into, the cheap insurance is the same. Fewer of your services sitting behind one company’s login means fewer decisions forced on you later, and it costs nothing to start with a free tier rather than a subscription.
One thing to do this week regardless of which group you are in. Open your app drawer and write down every app that did not come from the Play Store. Most people cannot name them from memory, and you cannot plan around a dependency you have forgotten you have.
Take one thing back off Google first
The realistic first move is not a new phone. It is reducing how much of your life sits inside Google, so that a decision about the operating system stops being all or nothing. Mail, files and passwords are the three that matter, and all three can move without touching your handset.
Affiliate link. We earn a commission if you subscribe, you pay the same either way, and the two tools recommended hardest in this article, F-Droid and GrapheneOS, are free and earn us nothing.
Prefer to take it one piece at a time? Our Proton Mail Plus review, Proton Drive vs pCloud comparison and Proton Pass write-up each cover a single swap, with the limitations printed rather than buried.
The BAIZAAR verdict
The 24-hour wait is not the story. It is a day, once, and then Android sideloading works much as it did.
The story is that a $25 fee and a passport scan are now the price of writing software that runs on other people’s phones, and that the component enforcing it ships through the Play Store rather than the operating system. Android’s licence has not changed. The gate simply moved somewhere the licence does not reach.
Google is not wrong that anonymous developer accounts are a live malware vector. It is wrong, or at least badly imprecise, when the same policy gets described as a fix for the class of attack that keeps succeeding against verified developers on the Play Store. Those are different problems. One of them is being solved.
So here is the part that undercuts everything above. For most people reading this in Britain, the right move in 2026 is nothing at all.
You have until 2027. The policy is unfinished. Moving to a de-Googled phone costs you banking apps, contactless payment and an afternoon of your life, in exchange for a problem that has not reached you yet. I run this stuff because I find it interesting. That is a hobby, not a recommendation.
Write down your sideloaded apps. Watch what happens on 30 September. Decide in January, with evidence.
If you want to do something useful in the meantime, move one service off Google rather than all of them. Mail is the usual first swap, and it is reversible.
Android sideloading FAQ
Can I still sideload apps on Android in 2026?
Yes. Android sideloading is not being removed, it is being slowed down for apps from unregistered developers. You enable a setting in Developer Options, authenticate, restart, wait 24 hours once, then choose a seven-day or indefinite permission. Apps from developers who have registered with Google install normally with no delay.
Does the Android sideloading wait apply to every app I install?
No. The wait is one-time, triggered when you first enable installs from unverified developers. Once it has elapsed and you have granted the permission, further installs proceed without another delay until the permission expires or you switch it off. Turning it off and back on within ten minutes avoids restarting the clock.
Does ADB skip the 24-hour delay?
Yes. Google has confirmed that installs via Android Debug Bridge are exempt from both the advanced flow and the verification requirement. You need a computer with platform-tools installed, USB debugging enabled on the phone, and the command adb install app.apk. Fine for your own devices. Useless as a way of shipping software to strangers.
Will F-Droid stop working?
F-Droid the app keeps running, and apps you already installed keep running. What breaks is installing and updating apps whose developers have not registered with Google, on certified devices, once enforcement reaches your country. F-Droid has said the project in its current form could not function if the rules take effect as written.
Are GrapheneOS and LineageOS affected?
No, not by default. Developer verification is enforced by the Android Developer Verifier service. That service is part of Google Play Services and is absent from AOSP builds without Google apps. GrapheneOS, LineageOS, CalyxOS and /e/OS therefore keep unrestricted installation. Whether sandboxed Play Services on GrapheneOS changes that has not been publicly confirmed.
How much does Android developer verification cost?
A one-time $25 registration fee for an Android Developer Console or Play Console account, with no recurring charge. Organisations also need a D-U-N-S number. It is free from Dun and Bradstreet but can take up to 30 business days. The Limited Distribution account waives the fee entirely, at the cost of a 20-device ceiling.
Will apps I have already installed be deleted?
No. Enforcement blocks new installs and updates rather than removing existing apps. The practical effect is slower than deletion and lands in the same place: an app you cannot update is an app accumulating unpatched bugs. Google’s stated reason for blocking updates is that an app can turn malicious after installation.
Do I have to leave Developer Options switched on?
No, and this matters more than it sounds. Once the advanced flow is complete you can turn Developer Options back off while keeping your sideloading permission. Some banking and payment apps refuse to run while developer mode is active, so being able to close the menu afterwards resolves the most common objection to the whole process.
Does this affect the UK yet?
Not until 2027 on current plans. The 30 September 2026 enforcement date covers Brazil, Indonesia, Singapore and Thailand only. UK users may still see the advanced flow appear on their phones during the staged rollout, because the flow and the enforcement are being deployed on separate schedules.
Why is Google doing this?
Officially, to make it harder for malicious developers to distribute malware anonymously and re-register after a ban. Google compares it to an ID check at an airport, confirming identity separately from screening the bags. Critics point out that identity confirmation does not inspect code, and that the friction falls hardest on open-source software rather than on the commercial malware that keeps reaching the Play Store.
Could the EU block developer verification?
Possibly, but nothing has been blocked so far. The Commission has Digital Markets Act specification proceedings open on Android interoperability, opened in January 2026, and a written parliamentary question has asked whether verification complies with the DMA. The Court of Justice made the Android antitrust penalty definitive on 2 July 2026. None of that has produced an order touching this policy.
How we verified this
Every mechanic on this page was traced to Google’s own help pages or to the Android team’s public rollout post of 18 August 2026, checked on 30 August 2026.
Where Google states a policy, this page says policy. Where a figure is Google’s own internal measurement, it is labelled as unaudited. Where a number comes from community estimation rather than a published count, it is labelled as an estimate and not used to carry an argument. Where I am inferring a capability from architecture rather than from a stated intention, the paragraph says so in plain words.
Three claims circulating in coverage of this story were corrected before publication. The order of the advanced flow steps is not the one commonly reproduced. The free developer tier waives the fee as well as the ID check. The 85% F-Droid figure is not from an independent analysis. Nothing here is a leak, a rumour, or an anonymous source.
Sources
- We’re rolling out the advanced flow for installing apps from unverified developers, Android Community Engagement Manager, r/Android, 18 August 2026. Primary source for the flow mechanics.
- Understanding Android developer verification, Android Developer Console Help, Google. Enforcement dates, participating stores, Limited Distribution terms.
- Android developer verification FAQ, Android Developers, Google.
- Google begins rolling out Android’s controversial new sideloading flow, Android Authority, 18 August 2026. Step sequence and reader poll figures.
- F-Droid and Google’s Developer Registration Decree, F-Droid, 29 September 2025. Signing model and the project’s own position.
- Keep Android Open. Coalition membership and campaign position.
- Malicious Android apps with 19M installs removed from Google Play, BleepingComputer, on Zscaler ThreatLabz research.
- 224 malicious apps removed from the Google Play Store, Malwarebytes, on HUMAN Satori’s SlopAds research.
- Google Android antitrust ruling shows the next battle is over who controls trust, FSFE, 28 July 2026. CJEU judgment of 2 July 2026.
- Google plans to restrict side-loading, declaring war on Android freedom, Tuta, August 2026.
Related BAIZAAR guides
- GrapheneOS duress password: the Atlanta border case explained
- The Google Incognito lawsuit: what it actually proved
- Proton VPN UK review 2026
- Proton Drive roadmap 2026: six features and one honest slip
- YouTube blocking Mullvad VPN: what works instead
- All BAIZAAR privacy coverage
