Cybersecurity Insights & Guides
Expert insights on cybersecurity, vulnerability management, and digital defence strategies.
Android 16 is now the submission gate: target API 36, and what the 1 November window actually is
Since 31 August 2026, Google Play has applied two requirements to two different sets of apps under one date, with two very different verbs. A new app or an app update must target Android 16 (API level 36) or higher to be submitted. An app already on Play must target Android 15 (API level 35) or higher to stay available to new users on newer devices. A team that has not shipped an update since it moved to API 35 is compliant on availability and blocked on submission the moment it tries to ship. Checked 2 September 2026.
The manifest two authorities regulate: RBI paragraph 12(i) and Google Play's Financial Services permission list
Two instruments reach the same AndroidManifest.xml. The Reserve Bank of India (Digital Lending) Directions, 2025 name the phone resources a Digital Lending App must desist from accessing, in prose, and permit a one-time access for on-boarding/KYC with the borrower's explicit consent. Google Play's Financial Services policy names eight Android permission constants for personal loan apps. Google's SMS and Call Log rule is written on what an app declares in its manifest, and says so in terms — including placeholder text — which puts the merged manifest, and every library that contributes a uses-permission line to it, inside the question. And a named Chief Compliance Officer of the Regulated Entity certifies that data collection and storage by DLAs comply with para 12 and 13. Every quotation checked 2 September 2026.
Every Play package must be registered by 30 September 2026 — and the install-side milestone is a different obligation
Two obligations, one date. Install-side verification enforcement begins on 30 September 2026 for users installing from seven named stores in Brazil, Indonesia, Singapore and Thailand, on certified devices running Android 7+. Separately, on the same date, all Play packages must be registered under Android developer verification, and Google's own word for the consequence is global removal from Google Play. Registration is decided on app signing key ownership and install share — which is why a rotated upload key, an agency-held key, or one package name shipping from two keys is a registration question rather than a paperwork one. Every quotation checked 2 September 2026.
Have a question this did not answer?
Our team answers regulatory and testing questions directly — no discovery call required to get a straight answer.
Talk to our team