Android developer verification starts September 30

Ask most founders who owns their Android app and they will name their company. From September 30, 2026, Google's answer depends on two things. It depends on whose developer account the app sits in, and who holds its signing key.

Google now requires every app on certified Android devices to be registered to a verified developer. The program starts in four countries and goes global in 2027.

Four countries now, every certified phone in 2027

Google describes the Android developer verification program as being like an ID check at the airport. It confirms who the developer is, not the content of the app. Google announced the program in August 2025. It opened early access in November 2025 and made it available to all developers in March 2026.

Enforcement applies to certified Android devices running Android 7 or higher. Certified devices are phones and tablets that ship with Google services and Play Protect. F-Droid counts these devices as more than 95% of Android hardware outside China.

Google says it picked the four initial countries because they are hit hard by app scams. For outside-Play distribution, the September enforcement applies to mobile and tablet form factors. Play developers must register apps across all form factors. Stores not on the list see no enforcement on September 30. Direct sideloading from websites is also unaffected for now.

Google recommends completing verification before the global rollout. The 2027 rollout applies to all apps on certified devices globally.

On an enforced device, an app from an unverified developer is unavailable for new installation. An unregistered app installs or updates only over ADB or through the advanced flow. The advanced flow has been live globally since August 2026. It is a one-time setup for power users. It requires enabling developer mode and confirming nobody is coaching the user.

The user must complete a restart and reauthentication. They wait a one-day period, and finally confirm the choice with biometrics or a PIN. The user can then install unverified apps for seven days or indefinitely, still with a warning. Your customers will not do that. For a business app the advanced flow is not a distribution plan.

F-Droid and the Keep Android Open campaign oppose the ID requirement. The campaign is backed by more than 70 organizations in 23 countries. This article focuses on the business side.

The app gets registered to whoever holds the account and the key

Verification requires two proofs. First, the developer provides identity proof like a legal name, address and contact details. They may also need to provide a government ID. Companies registering as an organization need a D-U-N-S number from Dun & Bradstreet. This number is free, and it can take up to 28 days to obtain.

A full distribution account in the Android Developer Console requires a one-time fee of $25. A limited distribution account is free and requires no government ID. This limited account lets hobbyists and students share apps to up to 20 devices.

Second, the developer proves ownership of each app. They do this by submitting an APK signed with the developer's private key. Multiple signing keys per package can be added to the registry.

Google Play automatically registers 99% of apps. Play apps that use Play App Signing are claimed automatically. They are claimed for the Play developer account that holds them. A Play Console account can manage verification for apps distributed outside Play too. If your agency published the app from its own account, the app is registered to the agency.

Outside Play, registration needs the signing key. Google's own FAQ states a developer who loses the signing key cannot register the packages.

If a package name is already in use and your key is not eligible to claim it, Google suggests choosing a different package name. Otherwise, an extra review is needed and that package name may also be used by other developers. A new package name is a separate app to Android. Existing users do not receive updates from it. They have to install the app again.

One reassurance applies to apps built under NDA. Verification does not collect information about app content or functionality. Registering does not expose confidential material.

We publish client apps under the client's own Google Play developer account, and the client keeps the signing key. We have also taken over an app whose Play account or keystore sat with a previous agency or freelancer. Recovering it was part of the job. Verification turns that kind of loose end from an inconvenience into a hard dependency.

A six-point ownership check for this week

Run this short check with your developer to confirm your app ownership is secure.

1. Look up the developer name on your Play listing. If it is not your company, ask your developer for an app transfer to your own Play developer account (Play Console supports transferring apps between accounts).
2. Ask your developer whether the app uses Play App Signing and who holds the upload key and any other signing keys. Get the answer in writing.
3. List every channel the APK reaches users through: Play, Galaxy Store, Xiaomi, your website, kiosks, managed devices. Anything outside Play and outside a managed store needs registration before 2027.
4. If you will register as an organization, you or your team should request the D-U-N-S number now. It can take up to 28 days.
5. Check the status. Play Console shows it on the Android developer verification page. The Android Developer Console shows Registered, Not registered or Draft per package on the Package names tab. Android Studio Panda 4 and higher shows it when you build a signed bundle or APK. Two APIs, the Android Developer ID Status API and Android Developer Console API, support bulk registration from CI/CD.
6. Put it in the contract: the developer account, the signing keys and the package names belong to the client.

If your app is Play-only and sits in your own account, there is nothing to do but confirm it. Everyone else has until the 2027 rollout, and the checks above take an afternoon now.