Lucas Lasota,Jithendra Palepu,Dario Presutti /Jul 28, 2026Republish
After eight years of litigation, Europe’s highest court has dismissed Google’s appeal, upholding the European Commission’s finding that Google used its control over Android to make its own search engine harder to avoid. But while that legal battle focused on contracts and market dominance, Google is now looking to shape how trust is established across the Android ecosystem.
On July 2, the Court of Justice of the European Union delivered its final judgment in the Google Android antitrust case. The ruling made the penalty imposed by the General Court definitive. One of the most consequential technology competition disputes of the past decade, the case examined whether Google broke the law by using contractual restrictions, including anti-forking agreements, revenue-sharing arrangements, and tying practices, to preserve its dominance over the Android ecosystem and mobile search. The Court dismissed Google’s appeal.
Yet over these same eight years, Google has shifted how it maintains gatekeeper control. The latest iteration is the company’s developer verification system: starting in September 2026, developers worldwide who wish to distribute apps to certified Android devices will be required to agree to it.
The timing is striking. While the Android antitrust case asked whether dominant platforms could preserve their power through contracts, Google’s developer verification system points to something deeper: the next generation of platform control may operate through governance of trust itself.
Security claims and monopoly power
The pattern is familiar. Whenever a single firm has exercised control over a technological ecosystem, it has argued that greater openness threatens security. In the United States, the Bell System argued that allowing third-party devices to connect to the telephone network would compromise its integrity and reliability. In the landmark 1968 Carterfone case, the Federal Communications Commission (FCC) rejected a blanket prohibition on third-party devices, establishing that users could attach non-Bell devices as long as they did not harm the network. In 2007, Skype requested the US telecom regulator to apply the Carterfone case to the smartphone industryto prohibit telecom operators from restricting end-users’ freedom of choice regarding smartphones. This marked the beginning of net neutrality.
In 2004, Microsoft argued before European competition authorities that disclosing interoperability information would undermine Windows’ security architecture. The European bodies rejected security as a blanket justification for refusing interoperability, even while acknowledging the underlying concerns were legitimate.
Today, similar arguments continue to shape digital markets. Apple argues that the unfettered installation of apps (sideloading) and interoperability obligations under the Digital Markets Act (DMA) threaten the integrity and security of its systems. Before the Court of Justice of the European Union, Apple has argued that the DMA’s interoperability obligations raise questions of proportionality regarding fundamental rights.
With its developer verification, Google argues that unrestricted app distribution itself poses unacceptable risks to Android users. The use of security arguments to preserve control over technological systems is therefore hardly new and still as incorrect as it was in the past. The underlying security concerns may be real, but they do not necessarily justify centralized control by the incumbent where less restrictive and more interoperable alternatives are available.
Keeping control over the Android ecosystem: from contracts to trust
Android’s success was built on openness. Launched in 2007 as an open-sers more flexibility than competing platforms. The European Commission’s Android investigationlater revealed the tension at the heart of Google’s strategy, which sought to maintain control over an ecosystem whose appeal depended on appearing open
The investigation culminated in a landmark 2018 decision finding Google in violation of EU competition law. Google appealed to the Court of Justice of the EU, which recognized that digital ecosystems cannot be understood through traditional market definitions alone. They require a “multi-level” and “multi-directional” analysis, since products, services, developers, manufacturers, and consumers interact across interconnected platforms.
That case closed only weeks ago, but it wasn’t the only one before the Courts in recent years. Another case, involving the Android Auto app, shows how Google increasingly relies on ecosystem and interoperability control rather than contracts alone. The CJEU examined interoperability questions referred by an Italian court in the dispute over an EV-charging app. Google had refused to make the app interoperable with Android Auto, citing security concerns and the absence of a specific template for EV-charging apps, since the available templates were limited to categories such as messaging and media apps.
The Court found that although Google hadn’t prohibited the app’s distribution, control over competitors’ participation in a digital ecosystem can itself be awhen, and under what technical conditions can shape competition as much as contracts do
Together, the two cases illustrate different generations of platform control:
- First generation:control through contracts (the Android antitrust case)
- Second generation:control through ecosystem governance and interoperability (the Android Auto case)
Who controls trust on Android?
Android revolutionized the mobile market by being under a Free Software license: anyone could run, install, distribute, and develop software, including alternative versions of Android itself. This vision of Android as a general-purpose computing platform is reflected in initiatives such as the Free Software Foundation Europe’s “Free Your Android,” which advocates for users’ freedom to install alternative operating systems and apps on devices they own.
This openness distinguished Android from competing mobile operating systems. Developers could distribute apps through commercial app stores, community repositories, direct downloads, enterprise channels, or other mechanisms, while users retained the freedom to decide which apps to trust. This model enabled alternative app stores, custom operating systems, and developer communities to be independent of Google.
Today, that model looks increasingly uncertain, with Google’s developer verification set to take effect in September 2026. The issue isn’t that distribution outside Google Play becomes impossible, but that the system creates growing dependency on Google’s own trust infrastructure. For developers and communities unwilling to enter into contracts with Google, such as competing Free Software app stores and operating systems, this raises a broader question: if apps remain installable but participation increasingly depends on approval from a single platform operator, in what sense does Android openness still exist? According to Google’s latest announcement, the first phase will apply not only to Google Play but also to six other participating app stores, before expanding to all certified Android devices globally from 2027.
The concern, then, is not outright prohibition but conditional participation. As net neutrality debates showed, competition can be distorted without blocking access altogether: app distribution may remain formally possible while becoming increasingly dependent on the terms, trust mechanisms, and approval processes of a dominant platform operator.
Historically, app distribution followed a simple model: developers created apps, and users decided whether to trust them. Google’s proposed verification framework inserts an intermediary into that relationship. Apps distributed outside Google’s trust infrastructure may remain installable, but increasingly subject to identity verification, warning screens, waiting periods, extra user actions, trust indicators, or other friction.
This shift is especially visible in the changing nature of “sideloading” itself. Google has announced that users wishing to install unverified apps may eventually need an “advanced user” flow, reserved for those willing to navigate additional security warnings and procedures. Even without banning alternative app distribution, additional warnings, delays and approval mechanisms could make independent distribution increasingly difficult in practice.
The global campaign Keep Android Open, organized by Android developers and civil society organizations, argues that Google’s developer verification program represents a fundamental shift in the character of Android itself: “Android, currently an open platform where anyone can develop and distribute apps freely, is to become a locked-down platform.” Whether one accepts this characterization or not, it captures an important transformation.
Google’s developer verification initiative also emerges within a broader regulatory environment increasingly focused on accountability, traceability, and risk management.
Recent European legislation, including the Digital Services Act, reflects a growing policy emphasis on trusted actors and accountability mechanisms. The European Commission itself has recently asked Apple and Google to explain how they verify businesses and mitigate financial scams under the Digital Services Act.
These developments reflect legitimate concerns. Online fraud, malware, software supply-chain attacks, and malicious actors pose genuine risks to users and societies.
Yet these regulatory frameworks generally prescribe outcomes rather than specific technical architectures. They do not require the creation of global identity systems for app developers, nor do they mandate that app distribution be centralized around a single trust authority. Furthermore, centralized verification may reduce competition over trust itself. Alternative app stores and Free Software repositories can offer different security models, curation standards, and forms of transparency. If Google becomes the mandatory authority for deciding which developers are trusted across certified Android devices, these competing approaches to trustworthiness risk being subordinated to a single standard.
Google’s developer verification regime therefore represents not merely a response to regulatory obligations, but a particular architectural choice about how trust and security should be organized in digital ecosystems.
Who governs trust?
The Google Android case may ultimately be remembered as one of the defining competition cases of the mobile era. It established important principles regarding contracts, ecosystems, and digital market power. But the judgment may also mark the end of one chapter in platform regulation, and the beginning of another. The Digital Markets Act itself can be read as an early institutional response to this shift: an attempt to move beyond case-by-case contractual remedies toward structural obligations on how gatekeepers govern their digital ecosystems.
It is becoming increasingly clear that the next struggle over digital markets may concern something even more fundamental: not who controls platforms, but who controls the governance of trust itself. This is why the answer cannot be left to gatekeepers alone, nor decided solely through litigation after the fact. In the long term, shared governance is essential; not only regulators, but also affected developers, users, and civil society should have a voice in how platform governance is designed, monitored, and enforced.
Support Tech Policy Press
If you’ve found our work helpful, consider supporting us.
Donate
Authors
Lucas LasotaDr. Lucas Lasota is a researcher, lecturer, qualified lawyer (Brazil) and project manager in the field of IT, telecommunications and contract law. His research focuses on regulatory measures of digital technologies and their impact on individual and collective rights, as well as on internet governan…
Jithendra PalepuJithendra Palepu is a Project Manager at the Free Software Foundation Europe, where he works on legal and policy issues relating to Free and Opens work covers software licensing, interoperability, digital competition, platform regul
Dario PresuttiDario Presutti is a Project Manager at the Free Software Foundation Europe. His work focuses on fostering the use of Free Software in public administration and promoting transparent, accountable digital infrastructures in Europe. With a background in Political Science and a Master’s degree in Intern…
