A private mandate that looks a lot like a public one
Starting September 30, 2026, Android devices in Brazil, Indonesia, Singapore, and Thailand will refuse to install or update apps unless their developer has verified with Google — submitting a legal name, address, and government-issued ID, or a D-U-N-S number for organizations (Android Developers Blog). The rule applies not just to Play Store downloads but to apps sideloaded from anywhere, across seven device makers' app stores including Samsung's Galaxy Store and Xiaomi's GetApps. Google says it will expand the requirement globally in 2027 (Android Developers Blog, March 2026). India is not in the first wave — but on current plans, it will not be exempt for long.
The design choice worth noticing is not that Google is verifying identity. It's who gets to demand it, and from whom. A single company is building a global registry that ties every Android app to a real-world identity, enforced at the operating-system level on devices that make up the large majority of smartphones outside China. That is precisely the architecture India's own Ministry of Electronics and IT reached for five years ago, when it required messaging platforms to make users traceable — except here the gatekeeper is a Mountain View corporation instead of an elected government, and there is no court, no Right to Information Act, and no Parliament to appeal to.
Steelmanning the mandate
Google's case is not frivolous. Malware and scam apps distributed outside Play Store review have been a real and growing vector — India alone recorded close to $2.4 billion in cyber-fraud losses in 2025, much of it funneled through fraudulent apps advertised on social platforms (MediaNama, September 1, 2026). Anonymous, unaccountable developers who can push a malicious update and vanish are a genuine security failure mode, and "who made this app" is a reasonable question for an OS vendor protecting a billion-plus users to be able to answer. Google has also built in a below-cost tier — a free, ID-free "limited distribution" account for students and hobbyists, capped at 20 devices (Android Developers Blog) — which blunts the harshest version of the open-source objection.
India's own traceability rule has an equally serious rationale. Rule 4(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, requires large messaging platforms to identify the first Indian originator of a message, but only in response to a judicial or Section 69 order tied to offences like sexual violence against children, threats to sovereignty, or public order — not a general surveillance power (PRS India, IT Rules 2021 billtrack). Enabling investigators to trace a specific piece of already-flagged criminal content is not, on its face, an unreasonable ask of a platform with 500 million-plus Indian users.
Where both arguments run out
The problem in both cases is the same: the safeguard applies to everyone, all the time, to catch a small minority who cause harm. WhatsApp's challenge to Rule 4(2), filed in the Delhi High Court on May 25, 2021 and still pending, argues that traceability cannot be built without weakening encryption for all users, and that message-level fingerprinting is a standing surveillance capability, not a case-by-case tool (PRS India; Wikipedia summary of the case timeline). PRS India's own review flags that the rule "leads to the retention of more personal data" than data-minimisation principles allow.
Google's version has the identical shape at OS scale: a permanent, centralized identity ledger of every Android developer on Earth, held by one company, with a single point of failure and a single point of coercion. The "Keep Android Open" coalition — 37 organizations, including F-Droid, which distributes apps largely from pseudonymous open-source contributors — has said the policy hands one firm control of the installation path for the large majority of Android devices outside China (per reporting in The Hacker News). A government body with a verification database at least answers to courts and RTI requests; a corporate one answers to its own privacy policy, which Google's own developer FAQ points to as the sole handling standard, with no detail on data retention or third-party sharing.
What India should actually do
The honest read is not "government good, platform bad" or the reverse — it's that centralized identity chokepoints deserve the same scrutiny regardless of who operates them. India isn't in Google's initial rollout, which gives MeitY a genuine window to act instead of merely react in 2027. Two things follow. First, whatever conditions India would impose on itself before expanding traceability — proportionality review, judicial oversight, a sunset or audit mechanism — it should be prepared to ask of Google's verification database too, given the systemic power it now holds over which apps 600 million-plus Indian Android users can install. Second, India's own traceability regime remains the weaker of the two by its own logic: it has been contested in court for five years without a ruling, while Google's mandate — for all its faults — at least ships a genuinely no-ID, capped-distribution path for hobbyists that Rule 4(2) has no equivalent of. Proportionate regulation should mean matching the remedy to the harm, whether the entity writing the rule sits in Delhi or Mountain View.