Google Won't Let Developers in Iran, Cuba, or North Korea Verify Their Android Apps at All

The exemption nobody asked for

Google's Android developer verification requirement kicks in September 30, 2026, starting in Brazil, Indonesia, Singapore, and Thailand before expanding further, according to Crypto Briefing. Every developer who wants an app installable on a certified Android device, Play Store or not, will need to hand Google their identity and a small fee.

The policy applies to essentially every Android phone running Google services, which is nearly all of them outside Russia and China, according to Ars Technica. Third-party app stores from Samsung, OPPO, and Honor are covered too. There's no carve-out for indie developers, hobbyists, or privacy tools. Everyone verifies, or their software doesn't install without jumping through Google's new sideloading warnings.

Except, according to a FAQ buried deep on Google's developer site, sanctioned nations get treated differently. The current US sanctions list includes Iran, Cuba, North Korea, and occupied areas of Ukraine. Google's FAQ says devices in those countries will be "excluded from Android developer verification checks," letting developers there keep distributing apps without verifying.

What "excluded" actually means

A Google spokesperson confirmed to Ars Technica that people living in sanctioned nations will not be allowed to go through verification at all. Not won't have to. Can't.

That's a real problem for a developer in, say, Havana. Right now, that person can build an app and distribute it globally. Anyone anywhere can sideload it after tapping through some warnings. Once verification takes hold, that developer's unverified app only installs easily inside sanctioned countries where the checks don't apply. Everywhere else, Google's new gate blocks it.

So the FAQ answer, as Ars Technica put it, dodges the real question. It frames the sanctions carve-out as a benefit for local users, when the actual effect cuts developers in those countries off from the rest of the world's Android users.

Why Google is doing this

This likely stems from US export control and sanctions law, according to Crypto Briefing's reporting. Google probably can't legally process identity verification data or run transactions involving people in sanctioned territories without violating US sanctions law. That's a compliance call, not a security decision.

Russia and China were already functionally outside the Google ecosystem. Russia's been building its own app distribution infrastructure for years, and China has never run Google Play. The sanctions exemption mostly formalizes what was already true for those two markets while extending the same treatment to smaller sanctioned regions like Cuba, Iran, and North Korea.

Sanctions law exists for real national security reasons, and companies that ignore it face serious legal exposure. Google isn't choosing to isolate developers in these countries out of spite. It's threading a legal needle that Congress and the Treasury Department, not Google, drew the lines for.

The bypass exists, but good luck finding it

Google has built an "advanced flow" that lets tech-savvy users bypass verification entirely, according to Ars Technica. It requires multiple steps, repeated warnings, and a mandatory 24-hour wait. That's a real option for developers and power users who know it exists.

Most people won't. A grandmother installing an app her nephew built isn't going to navigate a 24-hour delayed advanced flow with scary warnings attached. The bypass is a technical escape hatch, not a practical one for ordinary users.

Crypto developers watching closely

Google hasn't singled out cryptocurrency apps anywhere in its verification documentation, according to Crypto Briefing. But crypto adoption is growing fast in Brazil, Indonesia, and Thailand, three of the four countries where verification rolls out first. Developers who've historically avoided the Play Store to keep apps decentralized or censorship-resistant will now have to register their identity with Google regardless, even if they never touch Google Play.

The Electronic Frontier Foundation and Brave have both flagged the broader concern that verification requirements create friction that lands hardest on small developers and apps that challenge the big platforms, according to Ars Technica. That's a fair worry from people who've spent years defending an open Android ecosystem. Whether Google's advanced-flow bypass is a real enough safety valve to answer it remains untested, since the rollout hasn't started yet.

The rollout begins September 30, 2026, in four countries. Whether Google broadens the sanctioned-country list, or clarifies what happens if US sanctions policy shifts on countries like Iran, remains open. Google has not said when, or if, the verification requirement will expand globally beyond the initial four markets.