The trust boundary already moved

The verifier that decides whether Google has approved the app you are installing is already on your phone if you run Android 8 or higher. Google’s Android Developer Verification program (ADV) ships the check through Play Protect, the same component that scans for malware, and F-Droid estimates as many as 4 billion handsets and tablets already carry it. In a July 1 post, F-Droid describes that component as a service that cannot be blocked, disabled, or removed, sitting idle until Google turns enforcement on. The group’s deliberate framing is that Play Protect is now both the scanner and the vector.

Google’s published timeline sets the first enforcement for September 30, in Brazil, Indonesia, Singapore, and Thailand, roughly 580 million people, with global rollout through “2027 and beyond.”

Underneath the polemic is a registration requirement. To distribute Android apps, a developer creates an account, pays a fee, uploads government-issued identification, provides detailed personal information, and registers the identifiers and signing keys for every app they plan to ship, now or in the future. Google’s stated justification is malware. F-Droid’s objection is that central registration stops no first-time malware author; its only effect is to make a known repeat offender buy a fresh account and signing key to keep distributing. For that narrow case, F-Droid points to options it says were on the table: Play Protect could look harder at newly installed apps that request elevated permissions or arrive through suspect channels, or Android could adopt federated verification (the 2023 proposal “DCM: A Developers Certification Model for Mobile Ecosystems”) that lets users pick their own trusted curators instead of one gatekeeper.

Clause 6.5 of the Android Developer Console Terms of Service reads: “If You violate any of the Terms or if You distribute malware or other harmful applications, Google may terminate Your access to the ADC.” The document defines malware nowhere. F-Droid’s reading is that the working definition becomes whatever Google decides at a given moment, bent by its own commercial incentives or by a government with enough leverage. Their precedent is ad blockers, already barred from the Play Store and in some cases labeled malware. Once a single registry decides which developers are allowed to exist, an entire class of software can be pulled from every certified device at once by reclassifying it.

That is the boundary that moved. The decision about what runs on a device you own shifts from you and the developer who signed the code to a registry Google controls, and the check that enforces it runs locally and reports installs and launches back to Google. F-Droid lists the questions it cannot yet answer for users in the first four countries: what happens when you install or launch the F-Droid app, whether apps already installed through F-Droid get disabled or deleted, whether their data survives if they are removed, and exactly what the verification telemetry sends on each install and launch.

On adoption, Google has said over 99% of Play developers’ apps are now registered. F-Droid’s counter is that those developers were auto-opted-in through their existing Play Store agreements rather than asked. Against the program, hundreds of thousands have signed a petition, and the open letter at keepandroidopen.org carries more than 70 signatory organizations, among them the EFF, FSF, FSFE, ACLU, and Forbrukerrådet. F-Droid says legislators and regulators have so far been unmoved.

For anyone shipping Android software, the operational change is that the signing key you hold stops being sufficient to get your app onto a certified device; the identity Google holds for you is what counts. If you distribute outside Play, through F-Droid or direct APKs, in one of the first four markets, September 30 is the date Google’s timeline sets for installs and launches to start being gated, and F-Droid itself says it does not yet know the exact failure mode. It has reached out to Google and plans to publish more guidance for those affected.