Someone in Cuba or Iran can keep installing APKs with no new restrictions, but devs will suffer.
Credit: Ryan Whitwam
We are a month away from the initial rollout of Google’s Android developer verification system, which requires developers outside the Play Store to verify their identities, just like it does for devs publishing on its platform. The company contends this policy does not impinge on the platform’s open nature. Still, the restrictions will be a big change, and there are still some unanswered questions. An issue that has come up repeatedly in the run-up to verification is what will happen to devs who can’t verify because of where they live. It turns out that Google has a cryptic answer for that buried in an FAQ.
Developer verification will soon block the installation of apps from unverified developers on any Android device running Google services, which is functionally all Android phones outside Russia and China. Developers who want to keep releasing software, even if it’s not in the Play Store, have to provide Google with their ID and pay a small fee.
But what if you’re an Android developer living in a sanctioned nation? Currently, the US sanction list includes Iran, Cuba, North Korea, and occupied areas of Ukraine. Given the current uncertain state of US foreign policy, that list could change in the future. Google doing any business with developers in those places is a thorny issue, and it seems like the company has decided to just leave them hanging.
A rather lengthy FAQ a few levels deep on the Google developer site addresses various issues around dev verification. Smack in the middle is this:
How does this program impact developers in sanctioned countries? Devices in sanctioned countries will be excluded from Android developer verification checks. This allows any developer to continue distributing apps in these regions without verification, though users there won’t benefit from the enhanced security benefits of the program.
The wording is bizarre because the answer doesn’t directly address the most important question—it dodges it. The vague FAQ appears to suggest that these developers won’t be able to verify, but that’s OK because phones in their countries won’t require that. But this comes with a real downside for those people.
A Google spokesperson has expanded on the FAQ and confirmed to Ars that people living in sanctioned nations will not be allowed to go through the verification process. That means they will not be able to effectively distribute software through any channel internationally.
Today, someone making an app in, say, Cuba can distribute it freely around the world, as well as at home. Anyone can install it and see their work in action after tapping through a few sideloading alerts. In the coming months, that will no longer be the case. These unverified apps will only be easily installable in the sanctioned countries where verification doesn’t exist.
Advanced flow or no flow
Earlier this year, Google clarified its plans for the “advanced flow” to bypass developer verification. It requires a bunch of steps, scary warnings, and a 24-hour wait. That gives tech-savvy folks a way to get around the new restrictions, but most people won’t know such an option even exists. Verification will necessarily create a two-tiered system of apps: verified ones that anyone can install and unverified apps that almost no one can install. Google says this change is necessary to combat scam apps.
Paradoxically, the situation in sanctioned nations will actually provide more app freedom. And these are Google-certified phones at issue here. In places like Cuba and Iran, most phones are Android devices with full Google certification because they’re imported from other places where Google officially operates. So Google is essentially acknowledging in this FAQ that its mobile services are being used and nominally supported in these places.
Google probably sees this as a legal tightrope. It can’t engage with developers in these places to verify them, but it seems determined to move forward with developer verification. The solution, apparently, is to leave devs in these regions behind—no verification, but no enforcement, either. The rest of us will have a more restricted app experience as users, but most developers around the world will be able to distribute their software anywhere as long as they verify. Sanctioned developers, meanwhile, will be in a second-tier bubble. Google has therefore tied the ability to distribute Android apps to the whims of the US Treasury Department, which maintains and enforces economic sanctions.
Currently, Google plans to activate the verification restrictions on September 30 in Brazil, Indonesia, Singapore, and Thailand. The program is expected to expand globally in 2027.
