Sideloading Apps on Android Is Under Threat. Here's What Google Is Doing and What It Means for You

Sideloading apps is about to get a great deal harder on Android, and Google has already put the date in writing.

Google's own developer documentation says it plainly: "Starting in September 2026, Android will require all apps to be registered by verified developers in order to be installed on certified Android devices."

One sentence. That's the whole story. Android has always been different from Apple's iPhone in one genuinely important way: you could install whatever software you wanted on it. Not just apps from Google's official store, but any app, from any source, built by anyone. That openness is what let privacy-focused apps flourish, what let open-source stores exist, and what made Android genuinely different from the walled garden Apple built. Google is now moving to end that, on the 95-plus per cent of Android devices that run Google's certified software.

What is sideloading apps, and why does it matter?

Before we go any further, a quick translation of the terms you'll hear thrown around in this conversation.

• APK stands for Android Package Kit. It's the file format Android uses to install apps, like a .exe file on Windows. Every app you've ever downloaded, from anywhere, arrived as an APK.
• Sideloading means installing one of those APK files from a source other than the Google Play Store: a developer's website, a community repository, an alternative app store, or a file you downloaded yourself. Android has always allowed this.
• Open-source apps have code that anyone can read, audit, and verify. You don't have to take the developer's word that the app doesn't spy on you. Many of the best privacy tools in the world are open-source.

Sideloading apps is how open-source app stores work. It's how the apps we install on every FreedomTech device reach your phone. And it's exactly what Google is now putting conditions on.

What Google is actually requiring

Under the new policy, every app installed on a certified Android device must come from a developer who has registered with Google and verified their identity. That covers not just the Play Store, but every app from every source. Sideloading apps, downloading directly from a developer's website, installing from alternative stores, all of it requires a verified developer from September 2026.

To register, developers must go through Google's Android Developer Console and hand over their legal name, home address, email address, and phone number. In most cases they'll also need to upload a government-issued ID. Organisations need a D-U-N-S number on top of that, a business identifier that can take up to 30 business days to obtain.

There's a free Limited Distribution tier for students and hobbyists that skips the government ID and allows distributing to up to 20 devices. The paid Full Distribution tier costs US$25 as a one-time fee and requires full identity verification. Enforcement begins September 2026 in Brazil, Indonesia, Singapore, and Thailand, with global rollout following in 2027.

What happens to F-Droid, and why that matters

F-Droid has been the gold standard for open-source app distribution on Android for over 15 years. It hosts around 5,000 apps, all open-source, all reviewed for privacy compliance before listing. If you're running a FreedomTech deGoogled phone, F-Droid is your primary app store, and every app in its catalogue is publicly auditable. That's not a marketing claim, it's technically verifiable by anyone with the time to look.

The problem F-Droid faces is structural, and it has no clean answer on certified Android devices. F-Droid doesn't just host apps. It takes open-source code, reviews it, compiles it, and distributes it signed with F-Droid's own cryptographic key, not the original developer's key. Google's new system wants each app tied to one verified developer identity. As the New Stack reported in a March 2026 interview with F-Droid board member Marc Prud'hommeaux, Google wants only one signature per app, which breaks every version of an application distributed through F-Droid or any other store.

That leaves F-Droid two options, both impossible. Compel thousands of anonymous volunteer developers, many of whom are anonymous for good reason and many of whom will simply say no, to hand their personal identity documents to Google. Or register every app under F-Droid's own identity, claiming ownership over code it didn't write.

What about the other app sources?

F-Droid isn't the only way people sideload. Here's where the main alternatives stand under the new rules.

Google's workaround: the "advanced flow"

After the initial backlash, Google announced that power users would be able to install unverified apps through what it's calling an "advanced flow." On 19 March 2026 it published the details, and the Keep Android Open campaign has documented the full process. Read it and decide for yourself whether this is a genuine solution or deliberate friction:

Ten steps. A mandatory 24-hour delay. Multiple warning screens engineered to make you feel like you're doing something dangerous. And a 7-day expiry if you chose the temporary option, meaning you get to do it all again.

As of this writing, the advanced flow doesn't exist in any shipping Android software. It's a blog post and some mockup screenshots.

The good news: if you're on GrapheneOS, you're fine

This is what I tell every FreedomTech customer who asks me about this. Based on It's FOSS, the Keep Android Open campaign, Reclaim the Net, the Consumer Rights Wiki, and the GrapheneOS community forums themselves: GrapheneOS, CalyxOS, LineageOS, and /e/OS are outside the scope of this policy.

The reason is technical and worth understanding. Google enforces this policy through Google Play Services. GrapheneOS deliberately does not include Google Play Services. It is not a certified Android device in Google's ecosystem, so the enforcement mechanism simply isn't present. The GrapheneOS forum thread on this is titled, in plain terms, "Are we screwed? (no, doesn't apply to GOS)." That's a pretty clear answer.

One more thing worth mentioning: in March 2026, Motorola and the GrapheneOS Foundation announced a partnership to engineer future Motorola devices with GrapheneOS compatibility. For the first time, GrapheneOS is expanding beyond Google Pixel hardware. The project isn't retreating, it's growing. That said, this is a practical exemption based on how Google currently enforces the policy, not a written guarantee, so it's worth keeping an eye on grapheneos.org for updates.

Is Google's security argument convincing?

Google's stated reason for all of this is reducing malware. Their August 2025 announcement claims that apps installed from outside the Play Store contain over 50 times more malware than Play Store apps.

I'll give them this: there is a real malware problem in the Android ecosystem. Scam apps are genuinely hurting people, particularly in markets like Indonesia, Brazil, and Thailand, which, not coincidentally, are the first countries where enforcement begins. That part isn't manufactured.

But the argument has an obvious hole. As the Keep Android Open campaign notes, Google's own Play Store distributed 77 malicious apps that racked up over 19 million downloads. The platform Google holds up as its security benchmark has repeatedly hosted the exact malware Google claims to be fighting.

There's also a more principled objection. The open letter signed by 56 organisations, including the Electronic Frontier Foundation, Free Software Foundation Europe, Tor Project, Proton, and Vivaldi, argues that Android already has multiple security mechanisms that don't require handing your government ID to Google. What this policy actually does is give one corporation a chokepoint over every app on every certified Android device on the planet. F-Droid's model, where every line of code is publicly visible and auditable, arguably provides a stronger security assurance than a name and a passport scan.

Who is actually affected

Strip out the detail and it comes down to which side of the certified-device line you sit on. If sideloading apps is part of how you use your phone, this is the part that counts.

The bigger picture

This is the thing that should sit with you. Android launched as an open platform. The ability to sideload apps, to install whatever software you chose from whatever source you trusted, was a genuine competitive advantage over Apple and a genuine promise to users. That promise is being walked back.

As It's FOSS put it, centralising all app distribution under Google's registration system hands one corporation the ability to cut off any app on any certified Android device globally. That kind of consolidated authority over a platform used by billions of people is unsettling.

I agree, and I'd add one more thing: this policy means a government anywhere in the world can ask Google to deregister a developer, and that app disappears from over three billion phones. Not just from the Play Store. From everywhere. Think about what that means for journalists, activists, whistleblowers, and ordinary people who rely on apps that powerful institutions would rather not exist.

If you're in Australia or New Zealand and want to raise this with regulators, the Keep Android Open campaign has contacts listed. In Australia, you can report it to the ACCC. In New Zealand, contact the Commerce Commission. You can also give Google direct feedback via their Android verification feedback form. Whether it changes anything is another question.

FreedomTech · The Privacy Experts · freedomtech.com.au