Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android’s usual confirmation screens, and to update them in the background.
To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on devices running Android 17 QPR2 or later in supported countries, which do not include the US.
Today, a user installing apps from a third-party store must first enable the store to install apps, then confirm each install and each update. From December 1, a store in Google’s Registered App Stores program gets that permission automatically once it is approved, and its updates run in the background under the user’s own update settings.
Google announced the program in March, alongside changes it said resolved its disputes with Epic Games. Joining is optional, and stores that stay out will continue to operate as they do today.
Under Google’s rules, the store must still get the user’s explicit consent for each install and “must not install apps silently without user consent.” Large downloads and background installs must show a visible notification while they run.
If an install is started on another device, the store must show a notification that does not close automatically.
IT administrators can block registered stores from being installed on managed devices. Google’s program pages do not say whether the block also applies to a store that is already installed.
Beyond the catalog scanning, Google’s requirements say a store must:
- be registered as an organization and keep its developer identity verified under Android developer verification, Google’s identity check for app developers
- send every version of its own app to Google for malware screening, exactly matching the version it publishes on the web and through other channels
- work to keep malware and other potentially harmful apps out of its catalog
- fix major security flaws that come to its attention
- not block other app stores from being installed, interfere with them, or hide or change Android’s security notifications
- pay a $10,000 yearly fee, due before Google starts its review
Each store stays responsible and liable for everything in its catalog. Google won’t moderate the content in registered stores.
If more than 1% of install attempts or more than 2% of a store’s apps are found to be potentially harmful over a 30-day period, Google charges additional fees to screen and clean up the catalog.
A store that fails to meet any requirement, including paying on time, can be removed from the program until the issue is resolved. Google gives notice and a chance to fix it first.
Google’s program pages do not describe how submitted apps are scanned, how quickly new uploads are checked, or what results the checks produce.
Registered stores also get a Google tool, the Android Developer ID API, to check whether each app in their catalog comes from a verified developer and can be installed. Google recommends that stores block installs of apps that fail the check.
Android developer verification is a separate Google program, now in its first phase with seven app stores. Since September 30, certified Android devices in Brazil, Indonesia, Singapore and Thailand have checked that apps from those stores come from verified developers, according to Google. Google plans to extend the checks worldwide in 2027.
Availability follows each user’s home country. Short trips to unsupported countries do not turn off one-tap installs or automatic updates.
Android 17 QPR2 is one of Android’s quarterly platform releases (QPRs). Its latest version, released October 16, is still a beta, and Google’s release notes give no date for the final release.
In the US, a separate Google program for distributing third-party stores through Google Play has been in effect since July 22.
