Android’s new sideloading rules are here, and they come with a 24-hour lock!

When Google execs previously said sideloading would become a high-friction process on Android, they really weren’t kidding.

The company is finally sharing what Android’s new sideloading flow will look like in practice, and if you’re someone who installs apps outside the Play Store, you’re going to feel it immediately, and you’re going to feel it deeply.

This isn’t a subtle tweak or another warning screen you can quickly tap past. Google is fundamentally changing how sideloading works on Android for apps that come from unverified developers.

Google’s brand-new “advanced flow” for sideloading is designed specifically for what the company calls power users. It’s a deliberately slow and almost impossible-to-rush-through process that will allow advanced Android users to sideload apps from unverified developers, while giving them plenty of caution to keep them safe from malicious apps and bad actors. At the same time, the new process is designed to protect unassuming Android users who might be tricked or coerced into downloading unverified apps.

When Android’s new sideloading rules come into force, installing apps from developers without Google verification (more on that later) will become extremely tedious by design and require a 24-hour lock before users can install them. Here’s what the new flow will look like:

• Step 1: Enable Developer Mode
  No more quick toggles. You’ll need to manually enable developer options first, adding an intentional layer of friction.
• Step 2: Confirm you’re not being coerced
  Android will explicitly ask if someone is guiding you through disabling protections on your device as a direct response to scam tactics.
• Step 3: Restart your phone
  This cuts off active calls, remote access, or screen-sharing sessions, which scammers often rely on.
• Step 4: Wait 24 hours
  Yes, really. There’s a mandatory one-time, one-day waiting period before you can proceed and sideload an app from an unverified developer. Google calls it a “protective waiting period.”
• Step 5: Re-authenticate
  After the one-day wait, you’ll need biometric authentication or your PIN to confirm it’s really you. “Scammers rely on manufactured urgency, so this breaks their spell and gives you time to think,” Google notes in its blog.
• Step 6: Finally, install the app
  Only then can you sideload, with the option to allow installs for seven days or indefinitely. Even within that seven-day time frame, once sideloading is enabled you can install as many different APKs from as many different unverified developers as you like.

Even after all this, Android will still show a warning that the app is from an unverified developer, but at that point, you can tap “Install anyway.”

Essentially, Google is making sure that sideloading apps from unverified sources is no longer something you can do on impulse.

Google’s reasoning is pretty clear, and something the company has been saying for a long time now. Android today isn’t the scrappy, enthusiast platform it once was, it’s the primary computing device for billions of people.

Speaking about the new rules in an interview with Android Authority, Google’s President of the Android Ecosystem, Sameer Samat, said,

“You want a platform to be open, but you need a platform to be safe.”

In Google’s view, safety is increasingly at odds with how sideloading has traditionally worked. Attackers frequently use social engineering and panic-inducing phone calls about legal trouble or a family emergency to walk victims through disabling protections and installing malicious apps.

The problem isn’t that Android’s warnings don’t work. It’s that they are insufficient, and in high-pressure situations, people often ignore them. Google says the new system is designed to break that cycle.

The restart step will cut off scammers watching or guiding victims through installations. The 24-hour delay will kill the urgency that scams depend on, and the extra confirmation will give users time to pause and consider their actions.

Internally, Google even acknowledged that the 24-hour wait isn’t just about stopping scams, it’s also about what users will tolerate. Google told us that they worked with power users to land on a delay that’s annoying, but not deal-breaking.

The new sideloading flow is part of Google’s broader push that will require Android app developers to verify their identity with the company. Google wants to tie apps to verified developers in hopes of reducing the number of bad actors slipping through the cracks.

“We would like to be able to tell the user this app is from this source. Now, that doesn’t mean that the app is safe. The user still has to make decisions. But at least you know who it’s from, and you can decide better — Do I trust this person, or do I not? That’s very important,” Samat previously told Android Authority in a recent interview.

There are some exceptions to Google’s developer verification rules, though.

Limited distribution apps, such as student or hobby projects, can still be shared with up to 20 devices without full verification.

According to Google, “Limited distribution accounts and advanced flow for users will be available in August before the new developer verification requirements take effect.”

The company said it will be sharing more details and technical documentation regarding these updates in the coming days and weeks.

For everyday users, nothing changes as long as you stick to the Play Store. But if you use third-party app stores or install APKs manually, you’re now in for a much more restrictive process.

It remains to be seen how the developer community reacts to these changes and if they will encourage developers to sign up for Google’s new verification system. If your favorite developer decides to remain unverified, you’re going to have to go through the new process for any app you install from them.