The mobile app ecosystem has long been one of the key malware distribution vectors. Despite Google Play Store's automatic scanning through Google Play Protect, malicious apps regularly pass through filters, and sideloading (installation outside Play Store) remains a common malware delivery method. Google's announcement of new developer identity verification requirements is a significant step toward raising the bar for attackers distributing malicious Android apps.
What Does the New Verification Requirement Mean?
Starting September 30, 2026, certified Android devices in Brazil, Indonesia, Singapore, and Thailand will block app installation from developers who have not completed the Google identity verification process. Verification includes confirmation of an individual's identity or an organization's legal registration — depending on the type of developer account in Google Play Console.
This is the first phase of a global rollout, targeting countries particularly exposed to malware distribution through unverified developer accounts. Google announced the program will gradually expand to additional markets — meaning developers worldwide should treat this as a call to action, regardless of their location.
Why Does This Matter for B2B Companies with Mobile Apps?
For organizations distributing their own mobile apps — whether consumer-facing or internal employee tools — the new requirement has concrete operational consequences. Apps published by accounts without completed verification will not be available to users in covered markets from the deadline date. This is a potential business continuity risk for companies with customer or employee bases in those countries.
Beyond the direct operational risk, developer verification builds user trust and reduces the risk of your app being impersonated by competitors or cybercriminals. Verified developer accounts are easier to distinguish from malicious imitations, protecting the company brand and app reputation in the store.
How to Complete Verification and Are There Exceptions?
The identity verification process in Google Play Console is available to all developers and involves several steps:
- Logging into Google Play Console and navigating to the identity verification section in account settings.
- For personal accounts: document identity verification (passport, national ID) through a Google trusted partner.
- For organization accounts: verification by submitting company registration documents.
- Completing the process before the deadline for target markets.
Google has not announced exceptions for apps distributed exclusively internally through Enterprise Mobility Management (EMM) or Android Enterprise. Companies using these channels should consult with Google or their Android Enterprise partner to confirm whether their distribution method is subject to the new requirement.
AbejaIT: Support in Mobile App Management and Compliance
Managing mobile apps in B2B environments encompasses more than just development — it also involves compliance, developer account management, distribution policies, and security audits. At AbejaIT, we offer comprehensive services in mobile applications, covering both iOS and Android app development and advisory services on app lifecycle management and app store compliance.
If your company has apps on Google Play and wants to check whether your developer account status meets the new requirements, or you are planning a new mobile app deployment, contact us. Through our IT consulting services, we will audit your developer account status and propose an action plan to minimize the risk of availability disruptions for your app on covered markets. Google's deadline is an opportunity to update your entire mobile app management strategy.
Source: The Hacker News