Google's new Android Developer Verification program has drawn scrutiny from Brazil's competition authority ahead of its limited Sept. 30 launch.
The Administrative Council for Economic Defense of Brazil (CADE), has received at least six complaints concerning the program since July 14. Two more extensive submissions, filed by digital-rights organization Article 19 as well as Android user and lawyer Rolf Cristhian Zornig, requested preventive measures barring Google from implementing the policy while the authority conducts its initial assessment.
A preventive measure is a temporary order intended to prevent irreparable or difficult-to-repair competitive harm while CADE assesses the underlying allegations.
Article 19 and Zornig allege that the verification requirements and the process for installing apps from unverified developers could disadvantage independent developers and alternative app-distribution channels. Google argues that the program is a response to growing malware and fraud risks.
CADE already monitors Google's conduct in the Android ecosystem under a settlement agreement signed with the company, which includes obligations concerning the licensing of Google Play, the preinstallation or promotion of Google Search and Chrome, and commercial conditions imposed on device manufacturers.
Google clarified the new policy launch on Friday after being prompted by CADE on Sept. 16. The company said the program is a necessary and proportionate response to the growth of malware and fraud, including threats involving artificial intelligence.
The program requires developers to verify their identity and establish ownership of their apps before distributing them on devices certified for Google Mobile Services, but does not review or approve individual apps, Google said.
The initial rollout will begin on Sept. 30 in Brazil, Indonesia, Singapore and Thailand, which Google said were selected because of concerns about malicious Android activity and requests from local regulators for stronger security protections.
During this initial phase, the requirements will apply to distribution through seven participating app stores: Google Play, Honor App Market, OPPO App Market, Samsung's Galaxy Store, Transsion's Palm Store, Vivo's V-Appstore and Xiaomi's GetApps.
Google said the initial requirements will not apply to other distribution methods, including sideloading. A broader requirement is expected to take effect in 2027.
Developers that do not verify their identities may eventually be prevented from installing or updating their apps through covered distribution channels. Google said the standard registration fee is a one-time, lifetime payment of $25 covering administrative costs and investments in ecosystem protection.
The company argued that it currently lacks a way to "systematically track" and take action against developers responsible for known malware. It said the verification program is intended to increase security while preserving Android's open distribution model.
Google also argued that the program is "much less restrictive" than obligations accepted by Apple in that company's own settlement with CADE.
Advanced Flow concerns
Users seeking to install apps from unverified developers would retain access through an option known as Advanced Flow. Google said the process is intended for users who understand and accept the associated risks.
The process requires users to activate developer mode, undergo a check intended to detect possible remote-screen access or coercion, restart and reauthenticate their device, wait 24 hours, and subsequently confirm their choice using biometrics or the device's personal identification number. Users may then enable installations from unverified developers for seven days or indefinitely, although they will continue to see a warning before installation.
Google said the 24-hour period is a protection against social-engineering scams that rely on artificial urgency. And restarting the device is intended to interrupt remote access or ongoing calls through which a fraudster might be guiding the user, while later authentication seeks to confirm that the device owner is making the change.
Article 19 and Zornig argued, however, that the cumulative effect of the requirements could discourage users from installing apps distributed outside approved channels. Article 19 said the nine-step process could have an effect similar to a complete prohibition even if sideloading remains theoretically possible, while Zornig argued that users could abandon the process despite each individual requirement appearing limited.
Zornig said Advanced Flow should be reserved for situations involving demonstrably elevated risks rather than serving as the standard route for installing apps from unverified developers. He also warned that updates to unregistered apps could fail when Advanced Flow is not enabled, potentially preventing security updates to software already installed on users' devices.
Article 19 separately argued that there was no indication that requiring an identity document would make an app's code safer.
Zornig likewise raised concerns that updates to unregistered apps could fail when Advanced Flow is not enabled, potentially preventing security updates to software already installed on users' devices.
The lawyer described Google as simultaneously acting as the gatekeeper, judge and enforcer of the Android ecosystem through its control of the operating system, Google Play Services, Google Play Protect and the Android Developer Verifier.
He alleged that the combined requirements could increase entry and operating costs for independent developers and distributors, restrict consumer access to software outside Google Play, and degrade the installation and updating experience offered by competing stores and open-source repositories.
Zornig also challenged the use of the Dun & Bradstreet D-U-N-S number for organizations seeking verification, when Brazil already has a public and verifiable corporate taxpayer identification number, known as a CNPJ.
Article 19 asked CADE to require Google to refrain from implementing the developer policy and from adopting contractual clauses or other measures capable of producing the same effects, directly or indirectly.
It said suspending the program would not create reverse urgency because the interim measure would merely preserve the status quo while CADE assesses the policy.
Zornig's primary request asked CADE to prevent Google from imposing blocks, mandatory waiting periods or other conditions on the installation or updating of apps distributed through independent channels in Brazil until the authority's investigative unit, the Superintendence, completes its initial assessment.
As an alternative to complete suspension, he asked CADE to require installation and updating through repositories such as F-Droid and GitHub, direct downloads, and alternative app stores without identity-verification requirements for users or waiting periods longer than those applied by Google Play.
Other complaints
The other complaints submitted to CADE similarly allege that the program may create artificial barriers for independent developers, alternative app stores and open-source software. Some complainants argued that existing Android protections, including sandboxing and Google Play Protect, already address security risks and reduce the need for an additional identity-verification layer.
One complaint also alleged that Google uses its position in Android to favor Google Payments and that AI scanning of apps distributed through other sources could serve commercial rather than purely security purposes.
Another cited campaigns by developers opposing restrictions on APK installations and argued that the changes could reduce consumer control over Android devices and reinforce Google Play's position in app distribution.
Source: MLex
