You tap an APK on your screen, and the phone does not install the tool you chose. It wants a restart and a confirmation that nobody is standing over you. Then it makes you wait twenty-four hours.
That timer is Google's new front door on a computer you already paid for. They call it an advanced flow. I bought an Android because I could run a file I chose. Google now wants a government ID and twenty-five dollars from the person who wrote that file, then every package name registered, before the regular install path opens.
The pitch was a general-purpose computer that fit in your pocket. You hosted the file on your own server and dropped a link on a web page, and people ran it. Google is putting itself in the middle of that channel, including stores it does not run.
Papers Before the Install
Here's the thing. Starting September 30, 2026, developers who ship through partner storefronts in Brazil, Indonesia, Singapore, and Thailand have to hand Google a government ID and twenty-five dollars, then register every package name against a signing key. Samsung's Galaxy Store is in the first wave. Xiaomi's GetApps is in it too. Play is on that same list. The twenty-four hour wait is already the owner's path for an unverified file. Those partner stores start refusing the regular install that day unless the developer is in Google's directory.
To claim a package, the developer uploads an APK signed with a private key so Google can bind the name to the account. In 2027 the mandate expands globally to certified devices running Android 7 or higher, across install sources. F-Droid puts that certified hardware at more than ninety-five percent of Android-compatible devices outside China. Unregistered apps stop being available for new installation on that hardware where the rule is live. Google's free limited account skips the ID and the fee. It caps the software at twenty named devices.
A Name on Every Package
Google is building a directory of legal names attached to package names and signing keys. That registry lives inside a company that already answers legal demands around the world.
Corynne McSherry, legal director at the Electronic Frontier Foundation, named the exposure to Ars Technica. The program necessarily creates a database, she said, and that database is then vulnerable to subpoenas, warrants, and government demand. Developers of privacy tools have to put a legal name on that desk.
Nathan Freitas of the Guardian Project built ButterBox, a solar-powered microserver meant to hand out software with no grid. Certified phones still expect to reach Google's servers to check APK metadata. No network, no install. Marc Prud'hommeaux of the F-Droid board pointed at the other cut. Google is barred by law from taking registrations out of sanctioned regions, which locks those developers out of certified hardware altogether.
Keep Android Open put seventy-one organizations from twenty-three countries on a letter to Sundar Pichai. Developers who choose not to use Google's services, the letter said, should not be forced to register with Google or submit to Google's judgment.
The Play Services Leash
The checks utilize Google Play Services, not the Android open-source tree. A Google system service called Android Developer Verifier rides on certified hardware and asks whether the package is registered. Google can change the wait without shipping an operating system update. It can rewrite the warnings the same way. That leash reaches across the certified ecosystem, including storefronts Google does not operate.
The advanced flow is the twenty-four hour mechanism:
- Unlock Developer Options and toggle the unverified app setting.
- Confirm on screen that you are not being coerced.
- Reboot and unlock with biometrics or the device PIN.
- Wait a mandatory twenty-four hours.
- Come back and choose seven days or indefinitely, still clicking through the warnings.
ADB still works for now. That path needs a cable and a workstation. Everyone else who wants a file on a certified phone either hands Google papers or sits through the day-long wait, and the company that sold the open pitch is the one holding both keys.
0 comments