Keep Android Open: One Week Past the September 30 Deadline, Here's What’s Happening
When Google's Android developer-verification policy hit its first enforcement milestone on September 30, 2026, a lot of headlines predicted the end of sideloading. A week later, the reality is more specific (and less dramatic, thanks to all the noise people made!) than either the doom scenarios or Google's own framing suggested. Here's what's changed, what hasn't, and what it means if you run GrapheneOS.
What enforcement actually looks like
The rules are now live in Brazil, Indonesia, Singapore, and Thailand. On certified Android devices running Android 7 or newer in those countries, apps from unverified developers are now blocked by default — but only when installed through seven participating stores: Google Play, Samsung Galaxy Store, Xiaomi GetApps, HONOR App Market, OPPO App Market, vivo V-Appstore, and Palm Store. Direct web downloads are not yet covered, and Google has not confirmed whether they will be in the 2027 global rollout.
The workaround Google built for "experienced users" — the so-called advanced flow — is now documented in practice, and it lives up to the campaign's "obstacle course" description. To install an app from an unverified developer, a user must enable a setting in Developer Options, complete an authentication step, restart the device, and then wait 24 hours before the install can proceed. Apps that were already sideloaded before the deadline continue to work, but updating them now requires going through one of the bypass routes.
Two smaller details deserve attention from anyone tracking this policy. First, according to reporting by Android Authority, Google quietly tweaked the timeline language in its own blog post after the enforcement date passed — a reminder that this program's public documentation has shifted repeatedly, which makes independent monitoring of it more valuable, not less. Second, Google has reportedly still not issued a formal response to the Keep Android Open campaign's February 24 open letter to Sundar Pichai, Larry Page, Sergey Brin, and Vijaya Kaza. The policy stands; the conversation about it does not.
