Mar 22, 2026 · 5 min read
Google Is Adding a 24 Hour Wait Before You Can Sideload Android Apps—Here's Why
A new "advanced flow" for Android sideloading is designed to break the social engineering attacks that trick users into installing malware, but privacy advocates worry it goes too far.
The Problem Google Is Trying to Solve
One of Android's defining features has always been the ability to install apps from anywhere, not just the Google Play Store. This openness lets users run software from F-Droid, install beta builds from developers, or use apps that Google has declined to list. It also lets scammers trick people into installing malware. The attack works like this: a victim receives a message, whether through SMS, a phone call, or a malicious website, instructing them to download an app outside the Play Store. The app asks for elevated permissions, and the victim grants them. In many cases, the app then disables Play Protect, Google's built in malware scanner, leaving the device completely undefended.
Google's response, announced on March 20, 2026, is a new "advanced flow" that inserts friction into the sideloading process. Beginning in August 2026, installing apps from unverified developers will require enabling developer mode, restarting the phone, re-authenticating with biometrics or PIN, and then waiting 24 hours before the installation can proceed.
How the New Process Works
The new sideloading flow adds six steps where there used to be two. Users must:
- Enable developer mode in system settings
- Confirm they are taking this action voluntarily
- Restart their phone and re-authenticate
- Wait 24 hours
- Confirm the change again using biometric authentication or PIN
- Choose to allow unverified apps either indefinitely or for seven days
Android Ecosystem President Sameer Samat explained the reasoning: "In that 24 hour period, we think it becomes much harder for attackers to persist their attack." The logic is that social engineering relies on urgency. If a scammer tells you to install an app right now because your bank account is compromised, a forced 24 hour delay gives the panic time to subside. The victim may talk to a friend, search online, or simply reconsider.
Privacy Advocates Push Back
More than 50 organizations, including F-Droid and the Electronic Frontier Foundation, have raised concerns about Google's broader sideloading restrictions. Their argument is straightforward: making it harder to install apps from outside the Play Store increases Google's control over what software can run on Android devices. The Play Store is not a neutral platform. Google takes a 15 to 30 percent commission on app purchases and in app payments, and it has removed apps for competing with Google's own services or for political reasons.
The EFF has been particularly vocal about the mandatory developer verification requirements that take effect in September 2026, which will require app developers to submit government issued ID before distributing apps. For developers in countries with authoritarian governments, linking their real identity to a privacy tool or protest coordination app could put them at risk. Google's concession, free "limited distribution accounts" that allow sharing apps with up to 20 devices without government ID, is unlikely to satisfy critics who see 20 devices as an effectively meaningless limit for open source projects with thousands of users.
The Security Case Is Real
Privacy objections aside, the scam problem that Google is targeting is genuine. Android malware that reads users' notes apps to steal passwords was discovered just this week, distributed through sideloaded streaming apps. The ClickFix social engineering technique, which tricks users into running malicious commands, was behind 47 percent of initial access attacks in 2025. The pattern is always the same: convince the user to bypass security protections, then exploit the opening.
The 24 hour delay does not prevent sideloading. It makes impulsive sideloading harder. For a developer who regularly installs test builds, the one time setup is a minor inconvenience. For a retiree who has never heard of developer mode and is being coached through the process by a phone scammer, the additional steps may be the difference between keeping their savings and losing them.
What This Means for Android Users
If you sideload apps regularly, prepare for the new flow before it launches in August 2026. Enable developer mode and complete the setup process in advance so the 24 hour wait does not catch you off guard when you actually need to install something.
If you do not sideload apps, the change will not affect your daily experience. But it is worth understanding the broader context. Every time Google adds friction to sideloading, it strengthens the Play Store's position as the default and often only source of Android software. Whether that trade off, less malware in exchange for less user freedom, is acceptable depends on how much you trust Google to be a fair gatekeeper of the software you are allowed to run on your own device.