AINEWS
Verification starts Sept. 30 in four countries. The new gatekeeper is the Treasury Department.
On September 30, an Indonesian developer who wants their app to install without friction on a typical Android phone in Jakarta will need to clear a Google identity check. That check, Google now confirms, is bounded by the US Treasury Department's sanctions list. The people excluded from it are not in some far corner of the developer ecosystem. They are running their apps on the same fully Google-certified Android hardware that everyone else is.
The new rule is called Android developer verification. Starting in Brazil, Indonesia, Singapore, and Thailand on September 30, then rolling out globally afterward, Google will require anyone who distributes an Android app to prove who they are before that app can be installed on a certified device without warnings and friction. For the first time, the basic Android install experience (what happens when a user taps "install" on an APK from outside the Play Store) is gated by Google's identity check, not just by the device.
A Google spokesperson told Ars Technica that residents of US-sanctioned jurisdictions will not be able to complete verification at all. Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine are the named gap. In those places, unverified apps will continue to install easily, because the verification regime does not exist there. The practical effect is an inverted map: the only place a typical Android user can sideload (install apps from somewhere other than an official app store) without warnings is the place Google is legally prohibited from talking to the developer.
For everyone else, Google has built an "advanced flow" that lets a user bypass verification. It requires multiple steps, scary red warnings, and a 24-hour cooldown before the install goes through. A hobbyist app, a small business tool, or a build shared inside a developer community can still reach a phone, but only after the user has been warned, waited, and signaled that they are knowingly doing something Google considers unusual. On a typical consumer phone, the warning screen is the part that matters. Most users will not push through it. The 24-hour delay is the policy, not paperwork.
Google has tied the right to distribute Android software to enforcement of the Office of Foreign Assets Control's sanctions list, per its support documentation. That is a US executive-branch boundary, not a Google policy preference. When a future Treasury action adds a new jurisdiction, or tightens enforcement on an existing one, the Android app distribution map shifts with it, without Google holding a public rulemaking on the change. The sanctioned-country exemption is not a loophole. It is the visible evidence that the system is bounded by OFAC, full stop.
Most Android phones in Cuba and Iran are fully Google-certified because they are imported from officially supported markets like the UAE or Vietnam. A user in Tehran with a Samsung Galaxy bought through a Dubai distributor will get the same Google services, the same Play Store, and the same installer protections as a user in São Paulo. When the new rule lands, that user in São Paulo will face a verification gate the Tehran user will not. Google is explicit in its FAQ that the gap is the design.
Google's stated rationale is fighting scam apps, and the timeline and mechanics of the rollout were first reported by Ars in June. The new piece is the on-record confirmation that the sanctioned-country carve-out is the policy's structural rule, not a peripheral one. For most of the world's Android developers, the right to reach a phone is now conditional on a Treasury list they cannot influence and a Google identity check they can, in theory, clear. The two-tier system is not a bug in the policy. It is the policy.