Android Sideloading Rules 2026: What Changes for India

by | Android

android sideloading rules – person holding a smartphone to install apps

Short answer: Google has not banned sideloading on Android. From 30 September 2026, apps installed on certified Android phones in Brazil, Indonesia, Singapore and Thailand must come from developers who have registered with Google. India is not part of that first wave; Google says the requirement will expand globally from 2027. If you want to install an app from an unregistered developer, you can still do it through a new one-time advanced flow (with a 24-hour waiting period) or through ADB on a computer.

This guide explains the new Android sideloading rules in plain language, what they mean for Indian users, students who build their own apps, and small businesses that share APK files with staff or customers, and how to stay safe from the APK scams that these rules are designed to stop.

What is sideloading, and why is Google changing the rules?

Sideloading simply means installing an app from outside an official app store, usually by downloading an APK file from a website, a WhatsApp message or a file-sharing link. Android has always allowed this, and it is one of the reasons many people prefer Android over iPhone.

Advertisement
\n

The problem is that scammers use the same freedom. A common pattern in India is a WhatsApp message that asks you to install an ‘e-challan’, ‘bill update’ or ‘salary calculator’ APK. Once installed, the fake app can read SMS messages, capture OTPs and give fraudsters control of the phone. In February 2026 the Indian Cybercrime Coordination Centre (I4C) warned government employees about exactly this kind of APK scam linked to 8th Pay Commission salary messages, and advised people not to install APK files from unknown sources.

Google’s answer is Android developer verification: a system that links every app to a real, identifiable developer. If a scam app is traced back, the developer behind it can be identified and blocked from publishing again.

The Android developer verification timeline (2026–2027)

Here is the official timeline Google published on the Android Developers Blog in June 2026:

WhenWhat happens
June 2026A system service starts rolling out to most Android devices. It will later check whether an app comes from a registered developer.
July 2026Developer ID Status API goes live globally; early access opens for limited distribution accounts.
August 2026Limited distribution accounts (for students and hobbyists) and the advanced flow for power users launch.
30 September 2026Registration becomes required for users in Brazil, Indonesia, Singapore and Thailand.
2027 onwardsThe requirement expands globally to certified Android devices.

So, as of late October 2026, Indian users are not yet blocked from installing apps by unregistered developers. But the system service is already on most phones, and India is expected to be covered when the global expansion happens.

Which app stores are part of the system?

Google listed the stores whose apps must be registered in the first phase: Google Play, Samsung Galaxy Store, Xiaomi GetApps, HONOR App Market, OPPO App Market, vivo V-Appstore and Transsion’s Palm Store. That covers most phones sold in India, including Samsung, Xiaomi, Redmi, POCO, OPPO, vivo, Realme-style OPlus devices, Tecno, Infinix and itel.

For Google Play users, very little changes: Google says about 99% of Play apps were registered automatically. The rules mainly affect apps you download as APK files from websites, Telegram channels or WhatsApp.

The advanced flow: how to install apps from unverified developers

For people who know what they are doing, Google has added a one-time process called the advanced flow. It began rolling out gradually in August 2026, so it may not be on every phone yet. According to Google’s own description, the steps are:

  1. Turn on Developer options in Settings (usually by tapping the Build number seven times in About phone).
  2. Confirm you are not being coached – a short check that nobody is pressuring you to switch off security.
  3. Restart the phone and sign in again. This cuts off any remote-access app or active call a scammer might be using.
  4. Wait out the one-day protective period, then come back and confirm with your fingerprint, face unlock or PIN.
  5. Install the app. After accepting the risks, you can allow apps from unverified developers for 7 days or indefinitely. A warning still appears, with an ‘Install anyway’ option.

9to5Google reported that the setting appears in Developer options as ‘Allow apps from unverified developers’, and that you can switch Developer options off again after the advanced flow is enabled.

Why the 24-hour wait? Scammers depend on urgency. They keep the victim on a call and push them to install an app within minutes. A one-day delay gives you time to pause, talk to family and realise something is wrong.

What about ADB?

Google has confirmed that unregistered apps can still be installed with Android Debug Bridge (adb) from a computer. This is mainly useful for developers and testers, and it is not affected by the waiting period.

What the new Android sideloading rules mean for different users

Everyday users

If you only install apps from the Play Store or your phone brand’s store, you will probably not notice anything. Apps from registered developers install normally. The extra steps apply only to apps whose developers have not registered.

Students and hobby developers

Google created a new limited distribution account for students, hobbyists and learners. It lets you share an app with up to 20 devices, and it does not require a government ID or a registration fee. It launched globally in August 2026. This is ideal for a college project, a hackathon app or an app you test with friends.

Small businesses and freelancers who share APKs

Many Indian businesses share internal apps by APK: a delivery-tracking app for riders, a billing app for a shop, or a custom app a freelancer builds for a client. Before the global rollout in 2027, it is worth doing the following:

  • Register your developer identity and package names through the Android Developer Console (or Play Console if you already publish on Play).
  • Check whether your app’s package name is already registered using the Developer ID Status API or the console.
  • Tell staff not to install ‘updated’ APKs sent on WhatsApp unless they come from a known internal source.
  • If you are a freelancer building apps for clients, add registration to your project checklist and agree on whose account the app will be registered under.

Google Play developers

Google asked developers to check the Play Console home page and register any remaining apps by 30 September 2026, or risk removal from Google Play globally. If you missed a notice, check your console now.

How to check whether an APK is safe before installing

The rules help, but your own habits matter more. Use this quick checklist before you install any APK:

  1. Ask why you need an APK at all. Banks, government services and well-known apps are on official stores. Indian government departments do not send APK files on WhatsApp, as I4C has pointed out.
  2. Check the source. Download only from the developer’s official website, not from a forwarded link or a Telegram channel.
  3. Look at permissions. A wedding invite, challan or salary calculator never needs SMS, accessibility or device-admin access.
  4. Keep Google Play Protect on. It scans apps, including sideloaded ones.
  5. Never install while on a call with someone who claims to be from a bank, police, courier or telecom company.

What to do if you installed a suspicious APK

  • Switch on flight mode immediately to stop SMS and OTP interception.
  • Uninstall the app from Settings > Apps. If it will not uninstall, remove its device-admin or accessibility permission first.
  • Call your bank to block cards and UPI if you notice any unknown activity.
  • Report cyber fraud on the national helpline 1930 or at cybercrime.gov.in.
  • Change passwords for email, UPI apps and banking from a different, clean device.

For more on phone-based scams, read our guide on how to stop the AI voice scam and protect your family.

Is this the end of open Android?

Not quite. You can still install any app you want, but apps from anonymous developers now need an extra, slower step. Critics, including some open-source developers, argue that this gives Google too much control over which apps can easily run on Android. Google’s position is that sideloading stays possible for power users while scam victims get protection from high-pressure tactics. Both points are worth keeping in mind, and the final shape of the global rollout in 2027 may change based on feedback.

If you want to know what else is coming to your phone, see our explainer on Android 17 features and what they mean for your phone, and browse more guides in our Android section.

FAQ: Android sideloading rules

Has Google banned APK installation in India?

No. As of October 2026, the registration requirement applies only in Brazil, Indonesia, Singapore and Thailand. Google plans to expand it globally from 2027.

Will I still be able to install unverified apps after 2027?

Yes, using the one-time advanced flow (with a 24-hour waiting period) or ADB from a computer, according to Google.

Do I have to pay to register as a developer?

Students and hobbyists can use the free limited distribution account, which allows sharing with up to 20 devices without an ID or fee. Standard accounts follow Google’s normal developer requirements.

Do Play Store apps need the advanced flow?

No. Google says around 99% of Play apps were registered automatically, so they install as usual.

Sources