Google Starts Blocking Unverified Android Apps on September 30 and F-Droid Says It Cannot Comply

On September 30, 2026, Google activates mandatory developer verification in four countries: Brazil, Indonesia, Singapore, and Thailand. After that date, a certified Android phone in those markets will refuse to install any app signed by a developer who has not registered with Google and provided government-issued identification. This is not limited to the Play Store. It covers sideloaded APKs, alternative app stores, and apps passed directly between users.

We read Google's developer documentation, F-Droid's open letter, the EFF's objection, and the coverage from Cybernews, The Hacker News, and the F-Droid community forum. The policy has been public since late 2025, but the enforcement date is now 23 days away and the open-source community has not found a path through it.

What the Policy Requires

Every developer who wants their app to install on a certified Android device must create an Android Developer Console account. The requirements:

• A one-time $25 registration fee
• Government-issued identification (passport, national ID, or driver's license)
• Legal name, email address, physical address, and phone number
• Verified phone number
• For organizations: business registration documents

This applies to personal and organizational accounts alike. Once registered, the developer's package names are associated with their verified identity. Apps from unregistered developers will not install through the standard installation flow on certified devices.

The Escape Hatches Are Deliberately Narrow

Google has left two paths for installing unverified apps. The first is Android Debug Bridge (ADB), which requires connecting the phone to a computer and running command-line tools. The second is what Google calls the "advanced flow," a deliberately high-friction installation path that requires multiple confirmation steps. Both are designed to be too inconvenient for normal users, which is the point.

Devices without Google certification (phones running custom ROMs without Google Play Services) are unaffected. But most Android phones sold in the world come with Google certification, and most users have no interest in flashing a custom ROM to install an app.

Why F-Droid Cannot Comply

F-Droid is the largest open-source Android app repository, distributing thousands of free and open-source applications. Its signing model is the problem. F-Droid builds apps from source and signs them with F-Droid's own key. Under Google's policy, every individual app would need to be associated with a registered developer. F-Droid cannot force upstream maintainers to register.

Marc Prud'hommeaux, an F-Droid board member, put it plainly: "If Google pushes its obligatory developer registration proposal, this will mean the end of the F-Droid project and other free and open-source distribution sources. F-Droid's myriad users will be left adrift, with no means to install, or even update their existing installed applications."

The issue is structural, not financial. The $25 fee is trivial. The government ID requirement is not. Many open-source developers contribute pseudonymously. Some live in countries where associating their identity with certain software carries personal risk. Requiring them to register with Google or have their software blocked on every certified Android device is a nontrivial demand.

The Open Letter

71 organizations have signed an open letter demanding Google withdraw the policy. The signatories include the Electronic Frontier Foundation (EFF) and F-Droid. The letter argues that the policy gives Google unilateral power to disable any app across its entire ecosystem, threatening free speech, competition, and what the letter calls "digital sovereignty."

The EFF's position is that centralized developer registration creates a chokepoint. If Google decides a developer's registration should be revoked, every app they have ever published stops working on every certified device, not just in the Play Store, but everywhere. That is a level of platform control that did not previously exist for sideloaded apps.

Google's Position

Google frames the policy as a security measure. The developer verification page says the goal is to "protect users from harmful apps" by ensuring every distributed app can be traced to a verified developer. The company points to malware distribution through sideloading as the primary threat the policy addresses.

The security argument is not without merit. Sideloaded malware is a real problem, particularly in the four launch markets. But the policy does not distinguish between a malware author (who can afford $25 and a fake ID) and a hobbyist developer (who may not want their home address in Google's database). The registration requirement creates a barrier, but the barrier is higher for the people Google is ostensibly trying to protect.

The Global Rollout

Google has stated it will "expand these protections globally in 2027 for all apps distributed to certified Android devices." The four-country launch is a pilot. If it proceeds without legal challenge or significant backlash, the same rules will apply everywhere.

For developers in the US and Europe, September 30 is a preview. For developers in Brazil, Indonesia, Singapore, and Thailand, it is a deadline. And for F-Droid, it is the beginning of a structural crisis that the open-source community has not solved and has 23 days to figure out.

The Bigger Picture

Android's value proposition has always included openness. You can install apps from anywhere, build your own distribution channel, and distribute software without a gatekeeper. That proposition does not survive this policy intact. After September 30, openness comes with an asterisk: you can install apps from anywhere, as long as the developer registered with Google first.

The comparison to iOS is inevitable but imprecise. Apple never promised openness. Google did. Retreating from that promise while framing it as security is a harder argument to make when 71 organizations, including the EFF, are publicly calling it a power grab. Whether they are right will depend on how Google handles the inevitable edge cases: the pseudonymous developer in a hostile country, the academic researcher distributing a tool that Google's automated systems flag, the F-Droid maintainer whose upstream developers refuse to register.

Those edge cases arrive on September 30. We will be watching.