Android: New sideloading rules to remain fulfilled on device change

Sideloading on devices with Google's Android operating system will become more complicated – but somewhat less so than previously expected: A 24-hour waiting period, which must be observed in certain cases to perform the sideloading installation, will also be considered fulfilled for new devices if it has already been fulfilled on another device. A Google representative has now informed about this.

Google recently announced the new deadline for manually installing apps from unknown sources and is implementing it as part of an "Advanced Flow". Unknown here means: It is an APK file from a developer who has not verified themselves according to Google's new, strict guidelines. The background to the new Advanced Flow is a wave of fraud in South America and Southeast Asia, where perpetrators trick their victims into installing malware APKs on their devices through shock calls. This often involves the theft of credit card data or similar.

Advanced Flow as a compromise

From the outset, Google's new, restrictive policy on this matter has been in a dilemma: security for all users on the one hand versus openness for manual app installation on the other. The Advanced Flow is intended to be a compromise, albeit a tedious one: Users activate developer options on their device, then confirm that they are not acting under instruction (e.g., from fraudsters), restart their device (to interrupt possible calls with fraudsters), wait for the 24-hour period, and can then perform the installation.

At least there is a small relief on this topic: Anyone who has already activated the Advanced Flow on one device and then switches to another does not have to reactivate it here. Matthew Forsythe, product manager at Google, announced this in a video. Forsythe also makes one exception clear: Anyone installing their apps via the Android Debug Bridge (ADB) on a PC is not affected by the Advanced Flow and does not have to wait 24 hours; this is intended to remain the case in the future. However, disabling the deadline on the device via ADB is not possible, according to Forsythe.

Verification process for developers

The Advanced Flow can be activated permanently or for 7 days. As soon as it deactivates again, updates for the affected manually installed apps will be blocked. Users can deactivate developer mode again after activating the Advanced Flow without the Advanced Flow deactivating itself. Otherwise, it would be inconvenient, as some apps do not work in developer mode.

To avoid falling under the strict new rules with their apps, developers must verify themselves and their organization with Google and sign their app. Google has published more details in a blog post and a presentation PDF. Verification is now possible. According to Google, the new rules will come into effect for apps in Brazil, Indonesia, Singapore, and Thailand starting in September of this year and worldwide from 2027. They apply to certified Android devices, i.e., those with at least one Google service pre-installed. Critics accuse the company of making itself a gatekeeper for third-party app distribution channels through the mandatory registration.

(nen)