Google has set a date for one of the biggest changes to how Android phones install apps in years, and it lands first in three of Malaysia's closest neighbours: Indonesia, Singapore and Thailand. Malaysia is not on that first list, but the countdown to when it will be has effectively started.
Editor
Dinesh Raj chevron_right
Table of Contents
What Google is changing
Starting 30 September 2026, Google will require every app installed through the standard path on a certified Android device, including apps sideloaded from outside the Play Store, to come from a developer who has verified their identity with Google. According to Google's own Android Developers Blog, the rule takes effect first in Brazil, Indonesia, Singapore and Thailand, then expands to the rest of the world through 2027. Developers must submit a legal name, address, verified phone number and government-issued identity documents through a new Android Developer Console, alongside a one-time USD25 registration fee.
Google is not shutting the door on sideloading entirely. An "advanced flow" launching in August 2026 lets experienced users accept the risk of installing an app from an unverified developer, built with warnings designed to make the choice deliberate rather than accidental. A separate, lighter "Limited Distribution Account" tier, also live from August, lets students and hobbyist developers share an app with up to 20 devices using nothing more than an email address, no government ID or fee required.
One detail has drawn attention on its own: Google confirmed to Ars Technica, in reporting picked up by Crypto Briefing, that devices in countries under US sanctions will be excluded from the verification checks altogether. That is not a security choice so much as a legal one, since processing identity data for people in sanctioned territories would run into US export control law. In practice it preserves the status quo in markets like Russia and China, which already operate largely outside Google Play.
What it means for Malaysian readers
Malaysia is an overwhelmingly Android market, and sideloading here is not a fringe habit confined to piracy. Malaysians sideload for ordinary reasons: an APK for a bank or government app that lags behind on its Play Store update, a regional build not officially listed here, or an early version a developer shares directly with testers. Once developer verification reaches Malaysia, that behaviour starts running through Google's identity system by default, even with the advanced flow keeping a manual override alive for anyone who goes looking for it.
The more immediate story is the company Malaysia is keeping in this rollout, or not keeping yet. Indonesia, Singapore and Thailand were chosen for the first wave, and all three sit inside the same regional app market Malaysian developers already sell into. A Malaysian indie developer whose app reaches Indonesian or Thai users through channels outside the Play Store will feel those markets tighten well before Malaysia's own deadline arrives, because losing an unverified distribution route in a neighbouring market can cut off a user base overnight, regardless of what rule is or is not in force at home.
Why Malaysia isn't first
Google has not published its criteria for choosing Brazil, Indonesia, Singapore and Thailand ahead of other markets, and no stated reason turned up in Google's own material or in the coverage so far. What is clear is that sitting outside the first wave buys Malaysian developers and users time, not immunity. Google has already committed to a 2027 global expansion, which puts Malaysia on a defined runway rather than an open-ended one, and the account-tier split between full commercial developers and students or hobbyists is worth watching now, since it decides how much friction a small Malaysian developer faces once local enforcement does arrive.
Google's framing throughout has been that this is about malware, not about closing Android down. Whether Malaysian users experience it that way will depend on how the advanced flow behaves once it reaches this market, and how much warning Malaysian developers get before the deadline that Indonesia, Singapore and Thailand are living through first.
Image(s) courtesy of Mika Baumeister and Mohammad Rahmani on Unsplash.
