Third-Party Android App Stores: What Google Now Allows

In short: Under a program that opened on July 22, 2026, Google lets qualifying third-party Android app stores distribute their catalogs to US users through Google Play itself, under what Google calls the Third-party App Store on Play Program. Google still runs limited malware checks and spot audits, but day-to-day app review, payments, updates and support shift to the third-party store, not Google.

Android has always allowed installing apps from outside Google Play — a practice usually called sideloading. What's new is that Google is now opening its own front door to rival stores, letting them plug into Google Play rather than requiring users to hunt down a separate installer file. The change traces back to Epic Games' antitrust fight with Google, and it changes who is actually checking an app before it lands on your phone. Here's what the policy permits, what still gets checked, and what a reader should look at before tapping install.

What is Google's new third-party app store policy and why is it changing?

Under the program, qualifying US Android app stores can be distributed through Google Play to US users. Google's enrollment page states: "Starting on July 22, 2026, subject to the terms set forth and at this page, third-party US Android app distribution platforms or app stores ('app store') can be distributed through Google Play to US users ('3PAS on Play')," according to Google Play Console Help.

The policy follows a long-running legal fight. Epic Games sued Google over "Google's restrictions on the distribution of alternate app stores through the Play Store, restrictions on app developers who have little practical choice but to distribute their apps through the Play Store, and Google's rules governing in-app payments and the fees associated with them," the Electronic Frontier Foundation reported. A resulting court order means "rival, third-party Android app stores are now allowed to access the Play Store's catalog and to be distributed through the Google Play Store," per EFF's analysis, with developers also gaining more freedom over payments and distribution.

What security and privacy checks still apply to apps from third-party stores?

Google doesn't disappear from the picture entirely, but its role shrinks to spot-checking rather than scanning everything. To enroll, a store must agree to "Proactively and in good faith prevent the distribution of malware and Potentially Harmful Apps (PHAs) and prohibit illegal or fraudulent activity through robust policy enforcement," according to Google's enrollment requirements. Stores are also required to "Publish and in good faith enforce clear privacy policies, do not materially violate applicable laws and regulations (for example, COPPA, CCPA), and manage government requests appropriately."

Google's own review is deliberately limited. The company states it performs "Manual security review of an app or app update" only "if its automated review systems identify an issue with the app or if Google has other reasons to believe the app may constitute malware," and "Manual content review of an app or an app update" only "on a sample of apps or if it has reasons to believe that an app violates Google's content policies," per the same Google Play Console page. In other words, most apps in a third-party catalog never get an individual manual review from Google — automated systems do an initial pass, and only flagged apps or sampled content get a human look, with the store doing the rest of the checking itself.

Those error rates have hard caps, according to Google's enrollment page. A participating store "must not have more than 1% of malware distribution as measured by install attempts over a 30-day rolling window, across all devices, globally." Compliance with content rules is checked through spot audits rather than full review: "To ensure compliance with this program requirement, Google will conduct routine audits on a random sample of your catalog. In order to remain in the program, your app store must not exceed a 2% content policy violation rate among the audited apps in your catalog." That means a store can have a measurable slice of problem apps and still stay enrolled, as long as it stays under those thresholds.

EFF frames this shift as a trade, not a loss of protection. Because users can pick between stores, the group argues competition itself becomes a safety mechanism: "Android users are no longer trapped in an arrangement of feudal security with Google, where users must depend on the goodwill of a monopolist to protect them and guarantee their safety. If Google does not adequately protect their data or security, Android users can now switch to a competitor that does a better job," per EFF's deeplink post. EFF goes further, arguing that app store rivalry now extends beyond which apps are offered, the user experience, and developer fees, to competition over privacy and security as well, per the same EFF post. That's an argument for why rival stores could eventually do better — it isn't a guarantee that any specific store already does.

What permissions can third-party app stores access, and how is that different from Google Play?

The Android operating system's permission system doesn't belong to Google Play — it belongs to the phone's software layer, and it works the same regardless of which store installed the app. Android's own documentation explains that app permissions support user privacy by protecting restricted data, such as system state and users' contact information, and restricted actions, such as connecting to a paired device and recording audio, according to Android Developers' permissions overview. An app still has to declare which permissions it wants, and the operating system still decides whether to grant them — that mechanism doesn't depend on where the installer file came from.

What changes isn't the permission system itself, but who looked at an app's permission list before you saw it. Enrolled stores are required to "display essential app details, including app name, developer name, description, version, size, permission list, applicable legal disclosures, and contact information for the developer," under Google's Clear App Info requirement. That listing requirement means the information should be there for you to read — but whether it's accurate, and whether anyone verified it closely, depends on the individual store's own review process, not on Google's. Google's manual checks, as noted above, only kick in on a sample basis or when something looks wrong automatically.

What should I check before installing an app from a third-party app store?

Since Google's checking is now partial rather than universal, more of the work of vetting an app falls on the store you're using — and on you. A few things worth checking before you install anything:

• Look for the store's own privacy policy. Enrollment requires stores to "Publish and in good faith enforce clear privacy policies," per Google's program requirements. If you can't find one, that's a red flag before you've even installed anything.
• Read the permission list the store is required to show you. Because stores must display an app's "permission list" alongside developer name and contact information, per Google's Clear App Info rule, you can compare what an app is asking for against what it actually needs to do its job.
• Check who the developer is and how to reach them. The same Clear App Info requirement means developer name and contact details should be listed in the catalog entry, not just the app's own in-app settings.
• Remember support, updates and payments now run through the store, not Google. Enrolled stores must offer "direct and accessible customer support channels," according to Google's documentation — if an app misbehaves or a purchase goes wrong, you're dealing with that store, not Google Play's support system.
• Review your phone's existing permission grants regularly. It's worth checking which permissions you've already handed to installed apps, regardless of where they came from — see our guide to auditing app permissions and our broader Android privacy settings walkthrough.

Which third-party app stores meet Google's enrollment requirements?

Google's page sets out the criteria — security practices, privacy policy enforcement, clear app info, direct user support, and fees — but does not itself name which stores are currently live under the program. The requirements amount to a checklist: a qualifying store needs to proactively police malware, publish and enforce a privacy policy, display permission lists and developer details for every catalog app, offer its own customer support, and pay to enter the program. Enrollment carries "an upfront service fee of $15,000 to perform the necessary security and policy reviews during onboarding for distribution through Google Play," per Google's enrollment terms, part of which is credited back toward review costs, plus annual renewal fees afterward. Any store meeting those bars and paying those fees is eligible — but because Google's program page doesn't name participating stores, the practical test is the store in front of you: does it publish a privacy policy, show a full permission list and developer contact for every app, and run its own support channel?

What happens with payments, updates, and customer support for third-party app store downloads?

Those three functions move out of Google's hands and into the third-party store's. Google's requirement that stores offer "direct and accessible customer support channels," per Google's enrollment requirements, means that if an app crashes, a purchase fails, or you need a refund, you contact the store you downloaded from — not Google Play's support. Updates and catalog curation are the store's job too: Google's manual review happens only on flagged apps or random samples, as described above, so the store is the one deciding what stays in its catalog and when apps get updated. It's a bet that stores will compete to do this well — but it also means the quality of that support, and how quickly a bad app gets pulled, now varies store by store rather than being guaranteed by Google itself.