Google will require all developers to complete a verification process, regardless of which distribution channel they use, even if they do not plan to publish on Google Play.
Apps that do not comply with the new certification process may be blocked by the Android operating system.
The change will directly impact independent marketplaces like Uptodown or F-Droid, since their activity will now depend on a validation system outside their own distribution processes.
This measure will take effect in 2026 and will represent a major change for the open model that has long defined the Android ecosystem.
In mid-2025, Google announced a major change to how apps will be distributed in the mobile ecosystem. As of 2026, any developer who would like their app to be installable on certified Android devices (whether via Google Play, alternative stores, or direct download from the creator’s website) will be required to complete a mandatory identity verification process managed by Google. While this change was introduced as a security measure aimed at reducing malware and preventing malicious actors from distributing apps anonymously, it has a significant impact on software distribution through alternative app stores.
The new system will require developers to provide verifiable personal or corporate data. They will also need to register all their apps on the platform, specifying the signing keys that identify them. All of this, regardless of the distribution channel used for their subsequent publication. This represents a major structural change in the Android ecosystem, which has historically allowed app installation from multiple sources without relying on a single central authority, unlike Apple’s iOS ecosystem.
The implementation will be progressive: the system began with early access in 2025, will be available to all developers in 2026, and will be applied to certified Android devices in certain countries this year, with global expansion planned for 2027.
The real impact of Google dependency when distributing apps
A key aspect of these new policies is that they create a direct dependency between Android app distribution and prior approval from Google, the verifying entity. In practical terms, this means that even developers who never intended to publish on Google Play will have to do so if they want their apps to be installed easily on Android devices.
To carry out the process, they have proposed a registration method parallel to the Play Console’s. In both cases, it will be necessary to provide personal data, such as legal name, address, email, and phone number. Organizations must also provide a DUNS number, verify their website, and submit an official government ID certifying operability.
Setting aside privacy-related issues, for alternative platforms like Uptodown, this means an additional layer of complexity that did not exist before. This is not a technical limitation of the operating system, but rather an administrative requirement imposed at the platform level that may negatively impact many creators. Therefore, we oppose its unilateral implementation and support those raising awareness of this issue, such as the Keep Android Open initiative, which summarizes and argues against the negative effects of the change and is backed by several organizations and software creators.
A change that affects users who trust Uptodown to publish their apps
Uptodown is a legal marketplace with more than 200,000 registered developers and publishers who use the store as an official channel to distribute their software. Furthermore, in many cases, creators actively decide to publish their apps exclusively on our platform. Their motives are diverse: independence, greater control over distribution, alternative business models, or simply the desire not to depend on Google.
This is key: Uptodown is not simply an alternative repository, but a consolidated app store where many software creators officially publish, update, and manage their apps.
For these developers, the new requirements would represent an additional obligation that does not address a real technical need of their distribution model. Having to register in a system managed by Google, even when they consciously choose not to, introduces a completely unnecessary structural dependency that can nip legitimate business models in the bud if they disobey the policies of a marketplace they did not even intend to use. Apps that do not go through the verification process will be blocked by Play Protect when they attempt to be installed.
As a palliative measure, Google has subsequently confirmed that there will be methods for so-called “advanced users” to bypass this limitation. Still, needing to access hidden system menus, along with deterrent messages displayed by the operating system, is not a realistic option for most people, as those of us who deal with the alarmist “unknown sources” warning received when downloading APKs from external sources know.
The risk of mistaking the platform owner for the regulatory body
At its core, the Android operating system is open source. However, most devices use a commercial version of Android managed by Google that integrates several of its services and closed apps by default. This meant there were two branches of development: the AOSP (Android Open Source Project) and the commercial version used by manufacturers with a Google Mobile Services license agreement, which requires them to pre-install several Google products.
Recently, Google decided to centralize the process for publishing new versions of the operating system. This means the process is now opaque, does not allow third-party contributions, and eliminates the possibility of consulting development branches until the company officially publishes each new release. Although the company claims that Android will remain open and that it will not affect end users in any way, every new change in the ecosystem seems aimed at unifying the operating system and the company both conceptually and functionally.
This trend has become increasingly evident in recent years, particularly amid regulatory efforts across regions worldwide. In fact, the Digital Markets Act (DMA) sought to prevent large platforms from acting as “gatekeepers”, restricting competition or imposing disproportionate conditions on developers and users in Europe.
Uptodown participated in the process, collaborating on initiatives and conversations aimed at ensuring that the digital ecosystem remains open, competitive, and accessible. This commitment is part of Uptodown’s mission to defend an environment where developers can share their apps without relying on a single intermediary, and where users are free to choose how and where they install their software.
A shared responsibility
Google claims that mandatory verification will help improve security and reduce fraud, a legitimate goal that, in theory, would benefit the entire ecosystem. However, it is essential that these measures do not erode the principles Android has defined since its origins, or disregard the protection services and publishing policies of other legitimate stores besides Uptodown, such as F-Droid or Aptoide.
Android was born as an open operating system. This openness has allowed the birth of millions of apps, companies, and independent distribution platforms that enrich the entire ecosystem. Preserving this model means ensuring that developers can continue to choose how to distribute their software. It implies protecting the existence of alternative marketplaces. It represents maintaining the diversity and competition that made Android the broadest and most dynamic ecosystem in the mobile world.
At Uptodown, we will continue standing up for these principles, just as we always have. We’ll keep working with regulatory bodies, supporting developers, and providing a genuine, legal way to distribute apps.
Because the future of Android depends not only on technology but also on preserving its open spirit.
