An Open Letter Opposing Android Developer Verification

Wait 5 sec.

As we wrote about back in September in F-Droid and Google’s DeveloperRegistrationDecree,Google plans to enforce mandatory developer registration as a requirementfor building and distributing Android applications worldwide. Android,currently an open platform where anyone can develop and distributeapplications freely, is to become a locked-down platform, requiring thatdevelopers everywhere register centrally with Google in order to be able todistribute their software. This applies regardless of whether your softwareis distributed commercially on a competitive app store like the SamsungGalaxy Store, or through a non-commercial community app repository likeF-Droid, or even by offering your app as a direct download from a webpage. In all these cases, installing or launching any application on anAndroid Certified device (which constitutes over 95% of allAndroid-compatible devices outside of China) will phone home to Google toverify that the developer and the application has been approved.After an initial public outcry, Google rushed to assure developers that“sideloading is not going away”. This, as we pointed out in What We TalkAbout When We Talk AboutSideloading, is simplyuntrue. Sideloading, their pejorative term for the direct andunintermediated installation of software of your choosing on the device thatyou own, is indeed going away if they follow through on theirthreat. Furthermore, future app store competitors, be they commercial ornon-profit, will forever be disadvantaged by their developers being requiredto sign up with Google, bound to their (voluminous, non-negotiable, andever-changing) terms and conditions, pay a fee, upload government-issuedidentification, and register each and every one of their applications withGoogle.But didn’t Google back down on Developer Verification?There was a brief sigh of relief in November when Google offered vagueassurances in a blogpostthat they were going to design some “advanced flow” that might permit“experienced users to accept the risks of installing software that isn’tverified”. Some commenters went so far as to claim victory and assert thatGoogle had backed down from the program altogether. Such triumphalism waspremature and uninformed. We have since learned that no such “advancedflow” will be made available prior to the September lock-down. Theypurported to be “gathering early feedback on the design of this feature”,but this is also untrue: no such feedback has been sought from anyoneoutside of Google.Google’s official and unambiguous stance remains, according to theirdeveloper landingpage, that: Starting in September 2026, Android will require all apps to be registered by verified developers in order to be installed on certified Android devices.Google has refused repeated requests for concrete information about whatform their so-called “advanced flow” will take, but it is reasonable topredict that if and when it is ever made available at some future pointafter the lock-down takes effect, it will be maximally obscure andhigh-friction. Such uncertainty makes it impossible to assess the viabilityof any “advanced flow” as a work-around for preserving software freedom, andso we must disregard it until it has been demonstrated and vetted by thecommunity.Silence is consent; Resistance is not futileAccording to their officialtimeline,Google intends to open their developer registration console in March. Thisis the first phase of lock-down, where developers are to be offered thedubious privilege of paying Google so they can surrender their governmentidentification, register all their applications, and become forever lockedinto Google’s terms and conditions for app distribution.We unequivocally advise against signing up for this program, now or ever.But mere inaction is insufficient to offer meaningful resistance to theprogram. Individual developers must also become advocates for softwarefreedom: through their own projects, through blog posts, through socialmedia, and by contacting their regional regulators. It is only throughdeveloper complicity that Google’s lock-down of Android can succeed.F-Droid stands in solidarity as a signatory to the open letter publishedtoday atkeepandroidopen.org/open-letter.We join with such champions of free software and free speech as theElectronic Frontier Foundation, the Free Software Foundation Europe, theSoftware Freedom Conservancy, and dozens of other organizations around theworld in repudiating Google’s overreach.We implore Google to listen to the overwhelming opposition to this programand change course. The Android Developer Verification program is a grievousbreach of trust with the free and open-source community that helped propelAndroid to the dominant position it holds today in the mobile computingworld. There is still time to regain trust as a faithful steward of Android,and to work together with the community to seek sound and measuredapproaches to improving the security of the platform for userseverywhere. But that time, as can be watched on the countdown atkeepandroidopen.org, is quickly running out.