Android Was Built on Freedom. Google's Developer Verification Takes It Away

What I have always loved about Android comes down to one simple idea: the phone was yours. If I wanted an app, I could install it. It didn't matter whether it came from the Play Store, a developer's website, a friend's build, or F-Droid. That freedom was never a loophole. It was the whole point, and it is what set Android apart from the walled garden on the other side.

So let me be plain about where I stand on Google's new Android developer verification requirement. We oppose this heavily, because it goes against everything Android used to stand for.

"Android is for everyone. It’s built on a commitment to an open and safe platform. Users should feel confident installing apps, no matter where they get them from."

Google, Android Developers Blog

Here is what Google is doing. Starting September 30, apps installed through seven participating app stores in Brazil, Indonesia, Singapore, and Thailand have to be registered to a developer whose identity Google has verified, or they won't install on certified Android devices (Google, Android Authority). Direct APK installs and stores like F-Droid aren't blocked yet, even there (Keep Android Open). But Google has been clear about where this is going. Its own guide says it "will expand these protections globally for all apps on certified Android devices in 2027." The Philippines isn't in the first wave, so for us here, 2027 is the year this lands.

When it does, every developer who wants their app to install normally on a certified phone will need to hand Google their identity, along with their app's package name and proof of their signing key (Google). Think about what that means. An app that has never touched the Play Store, distributed by an independent developer to people who chose to install it, will still need Google's blessing. That is not a security feature bolted onto an open platform. That is a gatekeeper sitting in the middle of every install.

"Android, currently an open platform where anyone can develop and distribute applications freely, is to become a locked-down platform, requiring that developers everywhere register centrally with Google in order to be able to distribute their software."

F-Droid

And I keep coming back to the data. Google is building a central registry of who made every app on Android, tied to real names and government documents. Plenty of the developers I respect most build privacy tools, activist tools, and small community apps precisely because they don't want to live inside one company's systems. The Keep Android Open letter names exactly these people: privacy-focused developers, humanitarian groups, and activists in countries that criminalize their work. Asking all of them to register with Google first is not a small ask. For some of them it is a dealbreaker.

"This extends Google’s gatekeeping authority beyond its own marketplace into distribution channels where it has no legitimate operational role. Developers who choose not to use Google’s services should not be forced to register with, and submit to the judgement of, Google."

Keep Android Open open letter

Google says this is about safety. In its March announcement, it said its analysis "found over 90 times more malware from sideloaded sources than on Google Play," and it has built its case around scammers who stay on the phone and coach victims into installing a malicious app (Google). I take scams seriously. But that justification is weak, and it gets weaker the closer you look.

Start with the scam caller. Google's own answer to the coached victim is a 24-hour wait. A scammer who has spent days or weeks grooming someone can simply call back tomorrow. The waiting period inconveniences everyone, and the patient criminal least of all.

Then look at how people here actually get robbed. The scams I hear about in the Philippines are texts and calls that trick people into handing over bank or e-wallet logins and one-time PINs, or into sending money themselves. The Bangko Sentral ng Pilipinas has warned about exactly this, with fake texts carrying links "designed to steal access to victims' financial accounts" (Philippine News Agency). None of that needs an app install. A new note from the ASEAN+3 Macroeconomic Research Office found that 74 percent of Filipino scam victims who lost money said it went out through a digital or e-wallet transfer (AMRO). Google already knows this kind of fraud is the problem. That's why it built on-device Scam Detection for suspicious texts in Google Messages and for calls. Those are the right tools for that fight. Locking down app installs is not.

Verification also doesn't do what the word suggests. It ties an app to an identity. It does not make the app safe. Google Play has required developer verification for years, with expanded identity requirements announced in 2023, and malware still gets in: Zscaler's ThreatLabz found 239 malicious apps on Google Play that were downloaded 42 million times between June 2024 and May 2025 (Zscaler). Anyone determined to do harm can register with a stolen identity or a shell company. Honest developers are the ones who will dutifully hand over their IDs.

And Android already has defenses aimed squarely at sideloaded malware. Google Play Protect scans apps on the device, and Google added live threat detection to it in 2024 (Google). Since Android 13, restricted settings keep apps installed outside an app store from easily getting powerful permissions like accessibility access, and Android 15 extended that to more permissions, including the default SMS and dialer roles (Google, Android Authority). Those are exactly the permissions banking malware abuses. With all that already in place, this extra layer mostly lands on honest developers and on the people who choose F-Droid and other open sources.

"While we do recognize the importance of platform security and user safety, the Android platform already includes multiple security mechanisms that do not require central registration."

Keep Android Open open letter

Google will point to its concessions, so let's look at them honestly. Hobbyists and students get a free "limited distribution" account that skips the ID check but only reaches up to 20 devices (Google). Twenty devices. That's a class project, not a community. ADB still works, which is great if you own a computer, know what ADB is, and enjoy plugging your phone into it. And then there is the "advanced flow" for installing apps from unverified developers. To turn it on, you open developer options, confirm you aren't being pressured, unlock with your screen lock, restart your phone, and then wait 24 hours before you can finish (Google). Even after that, every unverified install comes with a warning.

I understand the logic of the waiting period. It is meant to break a scammer's spell. But look at what it says about how Google now sees us. Installing software on a device you paid for has become something you need a cooling-off period for, like a big purchase or a legal contract. A choice that used to take one tap now takes a day, and it is hidden in a menu most people will never find. That isn't preserving freedom. That is making freedom inconvenient enough that most people give up on it.

I'm far from alone in this. In an Android Authority reader poll earlier this year, 82 percent of respondents called the approach overkill or said it makes Android less open. F-Droid, which has quietly served free and open source apps for years, called the program "a grievous breach of trust with the free and open-source community" in a February statement and urged Google to "change course." It signed the Keep Android Open open letter alongside the Electronic Frontier Foundation, the Free Software Foundation Europe, the Software Freedom Conservancy, and others. The letter now lists 71 organizations from 23 countries. These are not fringe voices. They are a big part of the community that made Android what it is.

That is what stings the most. Android grew on the promise that it was open. Developers built for it because they didn't need anyone's permission. Users chose it because they could do what they wanted with their own phones. Taking that away one region at a time, with a few escape hatches that get harder to use, doesn't make it any less of a reversal.

We still have until 2027 before this reaches the Philippines. If you build Android apps, read F-Droid's statement and the open letter, and make your voice heard. If you're a user, tell the developers you rely on that you support their right to ship without asking Google first. And if you care about owning the device in your pocket, don't wait until the gate is already closed.

My phone should be mine. That's the Android I fell for, and it's the one worth fighting for.