What changed
Android developer verification links every app to a real, verified person or organisation. Since 30 September 2026, users in the four launch countries can only install an app from Google Play and six other participating stores (Samsung Galaxy Store, Xiaomi GetApps, OPPO, vivo, HONOR and Transsion) if the app's developer is verified and the app is registered.
Google says it will expand this globally in 2027, for all apps on certified Android devices, wherever they are downloaded from.
Unregistered apps can still be installed, but with friction. Users need either Android Debug Bridge (a developer tool) or a new "advanced flow". Android Authority reports that this flow asks the user to switch on an option in Developer Options, authenticate, restart the phone and wait 24 hours. You cannot ask a delivery driver or a distributor to do that.
Who is affected
Apps only on Google Play. You are probably fine. In June 2026 Google said most Play developers were already verified and over 99% of their apps were registered. Still, open Play Console and confirm the status for each app.
Apps shared outside Google Play. This is the group that needs to act. Think of a field sales app sent as an APK on WhatsApp, a dealer ordering app downloaded from your website, or a white-label app given to franchise owners. These need an account in the new Android Developer Console, a verified identity and registered package names.
Internal apps on staff phones. Google's Android Enterprise help page says private apps on unmanaged devices must be registered to stay installable and keep receiving updates. Apps on devices enrolled in mobile device management (MDM), either fully managed or with a Work Profile, are exempt.
A practical checklist
1. List every Android app you distribute
Include old and internal apps, not just the public one. Note how each is installed: Play, another store, a download link, or MDM.
2. Check who owns the developer account
Many businesses had an agency or freelancer publish their app. If the app sits in the agency's account, the agency is the verified developer, not you. Move it to a company account before you need an urgent update. This is the same ownership question we cover in our guide to staff augmentation, dedicated teams and project outsourcing: accounts, keys and code should belong to you.
3. Find the signing key
To register an existing app outside Play, you must prove you own it by signing a small test APK with the production private key. If nobody can find that key, you cannot register the existing package name and may have to publish under a new name, which means users reinstall. Store the key, its password and a backup somewhere your company controls.
4. Prepare the organisation details
Google's enterprise guide lists what an organisation account needs: a company domain email (generic Gmail addresses are blocked), a Google Payments profile with your legal name, address and D-U-N-S number, and a one-time USD 25 fee. Google's developer guide adds that organisations must verify their website through Google Search Console. Getting a D-U-N-S number can take time, so start early.
5. Register, then test an install
Register each package name and install the app on a test phone that is not enrolled in MDM. Do the same after your next update.
6. Consider MDM for company phones
If staff use company-owned phones, enrolling them in Android Enterprise management exempts private apps and gives you better control over them. It is a bigger change than registering an app, so weigh the setup and licence costs.
Common mistakes
- Assuming "we are not in those four countries" means nothing to do. The global rollout is planned for 2027.
- Letting an individual developer's personal account own a company app.
- Losing the signing key when a developer or vendor leaves.
- Testing only on MDM-enrolled phones and missing the problem on personal devices.
For teams that publish often, Google is also launching APIs to check registration status and register package names from a CI/CD pipeline.
Where Ascent24 can help
Ascent24 builds and maintains mobile and web applications for businesses. If you are not sure who owns your app's account or signing key, or you need to move an app built by another vendor, email info@ascent24.io or send us your details and we can review it with you.
FAQs
What is Android developer verification?
It is Google's requirement that Android apps be registered to a developer whose identity has been verified. Users can then install the app normally from participating stores and, from 2027, from other sources too.
Can unregistered apps still be installed?
Yes, through Android Debug Bridge or the advanced flow, but both are impractical for customers or field staff.
Our app is only used by employees. Do we need to register it?
Yes if it runs on unmanaged or personal phones. Apps on MDM-managed devices or Work Profiles are currently exempt.
What if we lost our signing key?
You cannot prove ownership of the existing package name outside Play without it. Talk to your developer about publishing under a new package name and planning the switch for users.
Sources
- Android Developers, "Android developer verification" guide (last updated 18 August 2026): https://developer.android.com/developer-verification/guides
- Android Developers Blog, "Android developer verification: Building a safer ecosystem together", 18 June 2026: https://developer.android.com/blog/posts/android-developer-verification-building-a-safer-ecosystem-together
- Android Enterprise Help, "Android developer verification for private apps": https://support.google.com/work/android/answer/17266330?hl=en
- Android Authority, "Android's controversial new developer rules are officially here", 1 October 2026: https://www.androidauthority.com/android-sideloading-developer-verification-first-wave-rollout-3717921/
