Türkçe sürüm / Turkish version
The Free Software Foundation Europe (FSFE) says Google's Android developer verification (ADV) risks undermining the openness that made Android successful. "Verifying a developer's identity is not the same as verifying that their software is secure," FSFE Project Manager Jithendra Palepu told CyberNews.
As part of our Keep Android Open dossier, CyberNews contacted the FSFE on 31 October. Lucas Lasota, Senior Programme Manager Legal, replied, and the FSFE answered our six written questions on 4 November. The answers were given by Jithendra Palepu, Project Manager at the FSFE, who agreed to be quoted by name. The interview was conducted in English by email; the answers below are published in full as given.
Also read: GrapheneOS: Play Integrity is not a security check
1. Why is Google's Android developer verification (ADV) a concern for software freedom?
One of the things that made Android exciting was the freedom it offered. Unlike Apple's tightly controlled iOS ecosystem, Android allowed people to experiment with their phones, install software from different sources, modify the operating system, and even develop their own Android distributions. For many people, including myself, Android was fun precisely because we could explore, hack, and customise our devices. It encouraged an entire community of developers and enthusiasts to experiment and innovate.
This openness also helped Google differentiate Android from Apple and contributed to its success. Free Software was not an obstacle to Android's growth; it was one of its strengths. With Android Developer Verification (ADV), however, Google risks undermining this unique characteristic. Developers who want to distribute applications without additional installation barriers on Google-certified Android devices are expected to register with Google, verify their identities, and register their applications, even when they operate entirely outside Google Play. Google maintains that sideloading will remain possible through an advanced installation procedure. But preserving a technically possible yet significantly more difficult process is not the same as preserving meaningful software freedom. Android offered something fundamentally different from Apple's ecosystem. The concern is that Google is gradually moving away from the very openness that made Android successful.
2. How will it affect free software developers and app stores like F-Droid?
Android's openness has allowed alternative app stores, independent developers, and even competing operating-system distributions to flourish. This diversity has been one of Android's greatest strengths. ADV introduces additional administrative, contractual, and financial requirements for independent developers. This is particularly concerning for volunteers, small community projects, and developers who value their privacy. F-Droid demonstrates why alternative approaches matter. Unlike Google's identity-based verification model, F-Droid reviews applications against its Free Software policies, examines publicly available source code, uses controlled builds, and supports reproducible builds that allow software binaries to be independently verified. This is a different approach to establishing trust, and it should be able to coexist with Google's model.
Google has also introduced the Registered App Stores (RAS) programme. It offers participating alternative app stores smoother installation and update mechanisms but requires registration with Google, a $10,000 annual fee, independent security certification costing approximately $3,000-$6,000, and continuous submission of application catalogs for Google's malware scanning.
Although RAS is voluntary, stores that do not participate will not benefit from the same installation privileges. This risks putting smaller, community-driven app stores at a disadvantage. For F-Droid, there is another question: its client allows users to add independently maintained repositories. Should F-Droid have to assume responsibility for applications distributed through repositories it neither operates nor controls?(this remains unclear as per the current RAS terms). Android became successful because different approaches to software development, distribution, and security could coexist. It would be unfortunate to lose that diversity by requiring everyone to follow one company's model.
3. What does it mean for users in countries like Türkiye, where sideloading and alternative stores are important?
For users in Türkiye, the consequences could include additional obstacles when installing apps from independent developers, alternative app stores, and community repositories. Installing apps from unverified developers could require navigating additional warnings and a waiting period.
One reason many people chose Android over an iPhone was that they could decide what apps to install and where to obtain it. Whether that meant experimenting with new applications, installing apps unavailable through mainstream app stores, or trying alternative Android distributions, Android offered possibilities that were difficult or unavailable in Apple's ecosystem.
We should not ignore that history. The ability to experiment with technology is not merely a feature for advanced users. It is how many people first learn to program, understand computers, and become developers themselves. Of course, security is important, and Google has legitimate reasons to address scams and malware. But verifying a developer's identity is not the same as verifying that their software is secure. Alternative approaches to software security also exist.
The challenge is to improve Android's security without losing the freedom that made it different from Apple in the first place. That matters to Android communities everywhere, including Türkiye.
4. Do you think the EU Digital Markets Act can limit this policy? Is FSFE taking any legal or policy steps?
The DMA provides an important framework for examining these developments. Article 6(4) of the DMA requires gatekeepers such as Google to allow and technically enable the installation and effective use of third-party applications and app stores. Article 6(7) requires effective interoperability with operating-system features. These provisions are closely connected because effective interoperability and independent software installation are essential for alternative services to compete.
The DMA recognises that operating-system providers need to protect security and integrity. However, restrictions must be strictly necessary, proportionate, and duly justified. The European Commission has also clarified in its Apple interoperability decision that protecting operating-system integrity does not give gatekeepers a general right to impose their preferred security and privacy models on third-party services. Although this interpretation concerns Article 6(7), its reasoning is relevant when assessing Google's restrictions under Article 6(4).
Take F-Droid, for example. Its security model is based on independent application vetting, Free Software policies, and reproducible builds rather than mandatory developer identity verification. Google should have to explain why such alternative approaches cannot coexist with its own security requirements. The FSFE has been engaging with policymakers, regulators, and the European Commission on device neutrality, interoperability, and software freedom. We have contributed to regulatory discussions on Android and supported civil society efforts to keep Android open. The DMA provides an opportunity to ensure that Android remains a platform where alternative applications, app stores, and independent developers can genuinely compete. We hope Google will reconsider measures that unnecessarily restrict this freedom.
5. What can users and developers do right now to keep Android open?
Users can explore Free Software applications, support projects such as F-Droid, contribute to alternative Android distributions, and share their experiences with others. Android's openness has always depended on people experimenting, learning, and contributing. Developers can continue publishing Free Software, maintaining independent repositories, improving reproducible-build practices, and developing innovative security approaches that do not depend exclusively on centralised verification.
Many developers and community organisations are already raising concerns through initiatives such as Keep Android Open. Users and developers can support these efforts and communicate their experiences to policymakers and competition authorities. Documenting concrete problems is particularly useful. When independent developers face additional fees, contractual restrictions, or installation barriers, those experiences help regulators understand the practical consequences of these policies. At the FSFE, we work to explain these developments, engage with policymakers and regulators, and demonstrate why Free Software and independent software distribution matter.
6. Is there anything else you would like our Turkish readers to know?
I would encourage readers to remember why Android was exciting in the first place. For many of us, Android was our introduction to the possibilities of Free Software on smartphones. We could install applications from different sources, modify our devices, explore alternative operating systems, and learn how software worked. That freedom inspired developers, researchers, and entire communities. Android showed that a Free Software based platform could become enormously successful while allowing people to innovate independently. It was a genuine alternative to Apple's much more controlled ecosystem.
Google faces legitimate security challenges, and ADV may help address some of them. But centralising control over software distribution can also introduce new problems, including dependencies on Google's infrastructure, barriers for independent developers, and reduced diversity in security approaches.
The discussion on ADV and RAS is not over yet. Things can still change. There are many people throughout the Android community who want it to remain an open platform, and there is still an opportunity for Google to work with that community to find better solutions.
Türkiye's Competition Authority (Rekabet Kurumu) is investigating Google's developer verification programme. CyberNews will keep updating the Keep Android Open dossier.
