Publishing on Google Play used to mean "pay $25, upload an APK, done." In 2026 it is a sequence of gates - account, identity, a second developer-verification layer, build format, listing, a stack of policy declarations, a mandatory closed test, and two separate reviews. Miss one and your app sits in limbo. This guide walks every requirement in the order you actually hit it, flags the 5+ biggest changes for 2025-2026, and is current as of June 24, 2026. Where Google's own pages are vague or lagging, we say so instead of guessing.
Table of Contents
The Complete Publishing Sequence (and Why Order Matters)
Google Play approval is not one approval - it is a chain of gates, each of which can hold the whole release. The biggest mistake new developers make is working out of order: building the app first, then discovering identity verification takes days, or finishing the listing only to learn a personal account still has to run a 14-day test. Do the slow, blocking steps early and run the rest in parallel. Here is the order that actually works in 2026:
Create the developer account
Pay the one-time $25 fee, accept the agreements, and pick personal or organization. Jump to details.
Pass identity verification
Upload your government ID (and a D-U-N-S number for organizations). This blocks publishing, so start it on day one. Jump to details.
Build an Android App Bundle at the right API level
Ship a signed .aab with Play App Signing, targeting API 35 today (API 36 from Aug 31, 2026). Jump to details.
Complete the store listing and App content declarations
Title, descriptions, icon, feature graphic, screenshots, plus Data safety, content rating, target audience, ads, and App access. Listing · Declarations.
Run the 14-day closed test (personal accounts)
At least 12 testers opted in for 14 continuous days. This is the longest fixed step and the one you cannot speed up alone. Jump to details.
Apply for production access
Answer the three-section questionnaire about your test, your app, and readiness. Review usually takes ~7 days. Jump to details.
Pass the final app review and go live
Standard reviews are quick; some take up to 7 days or longer. Then your app is in production. See the full timeline.
Stages overlap. Kick off identity verification and your closed test as early as possible, then finish the store listing and declarations while the 14-day clock is already ticking. Treating these as strictly sequential is what turns a 3-week launch into a 6-week one.
Step 1: The Developer Account and the $25 Fee
Everything starts with a Google Play Console developer account. You need a Google account with 2-Step Verification enabled, and you must review and accept the Google Play Developer Distribution Agreement and the Play Console Terms of Service during signup.
The registration fee is $25 USD, paid once. It is non-refundable and never recurs - there is no annual renewal. That single payment lets you publish an unlimited number of apps under the account.
Payment Methods (This Trips People Up)
The fee must be paid by credit or debit card only. Accepted card types vary by location, but Google's official guidance lists the following - and is explicit that prepaid cards are not accepted:
Accepted
Visa Mastercard American Express Discover (US only) Visa Electron (outside US)Not accepted
Prepaid cards PayPal for the fee Bank transferPersonal vs Organization: Same App, Different Paperwork
You choose an account type at signup. Per Google's official help, both types have access to the same functionality and both can monetize through a payments profile. The only real difference is the information Google collects to verify you.
Individual / Indie
Best for solo developers, hobbyists, and indie makers.
Company / Business
Required for finance, health, VPN, and government apps.
If you go the organization route, the D-U-N-S number is the hidden bottleneck. Per Google's official Android Developer Console Help: "The process can take up to 28 days so you should make preparations to obtain a D-U-N-S number." Request it before you do anything else, or it will gate your entire launch.
Changing your mind later is not a toggle. You can switch account type if your circumstances change, but converting an existing personal account to an organization is not a simple switch - it effectively requires re-registration. Pick the right type up front.
Which Account Type Do You Need?
Pick the description that fits you to see Google's required account type and what to prepare.
Personal account
Recommended for youA personal account is the fastest path: you need a public developer name, a verified email and phone, and one government ID. No D-U-N-S number, no business documents.
Heads up: if your account is created after Nov 13, 2023, you must complete the 14-day closed test with 12+ testers before production. Plan for it from day one.
Organization account
Recommended for youRegister as an organization to publish under your company name. You will need a D-U-N-S number (start this now - up to 28 days), a verified website, business documents, and a government ID.
The upside: organization accounts are exempt from the 14-day closed testing requirement, so you can go to production faster once verified.
Organization account (mandatory)
Required, not optionalFinancial-services, health, VPN, and government apps must use an organization account - a personal account will not be accepted. Get your D-U-N-S number and organization documents in order before you build.
Health apps have an extra deadline: existing health apps had to migrate to a verified organization account by Jan 28, 2026. See the 2026 changes recap.
Step 2: Account Identity Verification (and the "5-Day" Myth)
Before you can submit or publish anything, Google verifies who you are at the account level. Personal accounts upload an official government ID; organizations add a D-U-N-S number plus organization documents. Skip or stall on this and the consequences are real: you cannot publish, and unverified developer profiles and their apps can be removed from Google Play and blocked from republishing until verification is complete.
There is a widely repeated number you should ignore. Dozens of third-party blogs claim identity verification "takes up to 5 days." That figure is real, but it is attached to the wrong thing.
"Identity verification takes up to 5 days"
Repeated across countless guides. The "up to 5 days" line actually comes from Google's payment-method and bank verification page, not the identity-document page. It is the financial check, not the ID check.
Identity review is "a few days" (1-7 days)
Google's identity pages say document review "may take a few days," and the Google Payments Center states it "can take 1 to 7 days." The main identity-verification page gives no fixed processing time at all.
Practical takeaway: treat identity verification as "a few days, possibly up to a week," and reserve "up to 5 days" for payment or bank verification only. Either way, start both the moment your account exists - they run in the background while you build, but they hard-block publishing if they are not done.
One more thing to get straight before the next section: this account-level identity check is not the same as the new Android Developer Verification program. They are two different layers that arrived in 2026, and confusing them is easy. Here is how they differ.
Android Developer Verification: The Biggest 2026 Change
This is the single largest structural change to Android distribution in years, and it is brand new for 2026. Android Developer Verification is a separate program from the account-level identity check you just read about. It requires apps to be registered to a verified developer identity in order to install on certified Android devices - including apps distributed outside Google Play, such as direct APKs and third-party stores. First, see exactly how the two layers differ:
Account Identity Verification
Proving who you are to open and keep a Play Console account.
- Happens during Play Console signup
- Government ID (and D-U-N-S for orgs)
- Gates publishing on Google Play
- About Google Play only
Android Developer Verification
Registering an app to a verified identity so it can install on devices.
- Ecosystem-wide, separate program
- Register package name + signing-key fingerprint
- Affects sideloaded apps and other stores too
- Confirms WHO you are, not what the app does
Google's stated rationale, from the March 2026 Android Developers Blog, is security. Their framing is that verification is like "an ID check at the airport" - it confirms the developer's identity but does not review app content. The headline data point they cite:
The Rollout Timeline You Need to Watch
The program opened in March 2026 and ramps up through the year. The date that matters most is September 30, 2026, when enforcement begins in the first four countries.
Verification opens to all developers
Available via Play Console and the new Android Developer Console. Existing Play apps were auto-registered - Google expected to auto-register about 98% of Play apps, with the remaining ~2% needing manual registration. By June 2026, "most Play developers are already verified, and over 99% of their apps have been registered."
"Android Developer Verifier" service introduced
A new Google system service that checks whether an app is registered to a verified developer. It applies to certified devices on Android 7 or 8 and newer, appears in Google System services, and stays dormant until enforcement. Device rollout began around June 2026.
Free accounts and APIs roll out
June: early access to free Limited Distribution accounts. July: the Android Developer ID Status API launches globally, plus early access to the Android Developer Console API.
Limited Distribution and Console API go global
Limited Distribution accounts, the Android Developer Console API, and the advanced sideloading flow all launch globally.
Enforcement begins in 4 countries
Verification protections take effect for users in Brazil, Indonesia, Singapore, and Thailand. Participating stores include Google Play, Samsung Galaxy Store, Xiaomi GetApps, OPPO App Market, vivo V-Appstore, HONOR App Market, and Palm Store.
Global rollout
Google has said it will "expand these protections globally for all apps on certified Android devices in 2027." No specific global date has been announced yet.
Two Ways to Register: Full vs Limited Distribution
If you already paid the $25 Play fee, you are covered for full distribution. Brand-new for 2026 is a free tier aimed at students and hobbyists.
Full Distribution
Limited Distribution
Unregistered apps can still be installed via adb or a deliberately high-friction "advanced flow": enable Developer Mode, allow unverified packages, confirm the risks, authenticate, restart the device, then wait roughly 24 hours before the install completes. It is intentionally slow - the point is to make casual sideloading of unverified apps harder, not impossible.
Step 3: Build Requirements - App Bundle and Target API
The days of uploading a raw APK are over for new apps. Two build-level requirements decide whether Google Play will even accept your upload: the format and the target API level.
You Must Ship an Android App Bundle (.aab)
Since August 2021, new apps must publish as Android App Bundles - APKs are no longer accepted for new apps. (Existing APK-based apps can keep updating via APK, though migration is recommended.) Alongside this, Play App Signing is required for new apps: Google manages and protects the app signing key, while you keep an upload key to sign the AAB before you upload it.
Target API Level: Current vs Upcoming
This is the one most likely to confuse a first-timer, because the floor is moving. Read both lines carefully:
- In force today (June 2026): new apps and updates must target Android 15 (API 35) or higher. Wear OS, Android TV, and Android Automotive must target Android 14 (API 34) or higher. Existing apps must target at least API 34 to stay discoverable to new users on newer devices.
- From Aug 31, 2026: new apps and updates must target Android 16 (API 36) or higher.
As of this writing, Google's dedicated Play Console target-API help page still reads "API 35" and has not visibly been updated to state API 36. The API 36 deadline is confirmed by the Android Developers Blog (January 2025): "targeting API 36 will be required in August 2026 and targeting API 37 will be required in August 2027." So if you check the help page and see API 35, that is the lag, not a contradiction - API 35 is the floor today, API 36 becomes the floor for new submissions on Aug 31, 2026.
Step 4: Store Listing and Assets
Your store listing is what users (and reviewers) see first, and it has hard technical limits. Get the specs wrong and you cannot publish; get the content wrong and you get rejected. Here are the exact 2026 requirements:
Text Limits
30 chars80 chars4,000 charsApp Icon
512 x 512 px1 MBFeature Graphic
1024 x 500 px1 MBScreenshots
2 phone (to publish)8 per device type320 - 3840 px
Click to enlarge
The Icon Change Everyone Misses: 30% Corner Radius
New in 2026, per Google's official icon design specifications page (last updated June 15, 2026): you upload a full square icon and "Google Play dynamically handles masking. Radius will be equivalent to 30% of icon size." In plain terms, Google rounds the corners for you - quite aggressively. If your logo or text sits near a corner, it gets clipped. Keep key elements inside a roughly 15 to 18% safe zone.
Want to be eligible for featuring? Go bigger on screenshots. The hard publish gate is just 2 phone screenshots. But to qualify for large-format and recommendation (featuring) surfaces, Google's guidance asks for at least 4 screenshots at 1080px+ (16:9 landscape at least 1920x1080, or 9:16 portrait at least 1080x1920); games need at least 3. Tablet screenshots have shifted from optional to effectively essential (a minimum of 4 per tablet class) for tablet-optimized placement, and Wear OS listings need at least one 1:1 screenshot, minimum 384x384. These 4+ minimums are featuring-eligibility guidance, not a publish blocker.
A preview video is optional - use a public or unlisted (not private) YouTube link, with ads and monetization disabled. Supported screenshot device types span phones, 7" and 10" tablets, Chromebooks, Android TV, Wear OS, Android Automotive, and Android XR.
Metadata Rules That Get Listings Rejected
Google's listing best-practices are strict about promotional language. Keep your title, icon, developer name, and short description clean:
Do not use
Do instead
Your listing and screenshots must reflect the app's actual functionality. Mismatches between what you show and what the app does are a common rejection cause - screenshots must show the real in-app experience, not a mockup of features that do not exist.
Step 5: App Content and Policy Declarations
This is the section first-timers underestimate. The "App content" area of Play Console is a stack of mandatory declarations, and incomplete or inaccurate answers are one of the most common reasons a launch stalls or an account gets flagged. Here are the seven you will most often touch:
Privacy Policy
An active, public, non-geofenced URL (no PDFs). Apps for children must link it in the listing and in-app.
RequiredData Safety Form
Declares what data you collect and share. Required on closed, open, and production tracks - even if you collect nothing.
RequiredContent Rating
A questionnaire that assigns an age rating via the IARC. Apps with no rating are not allowed and can be removed.
RequiredTarget Audience
Declare your target age group(s). Including children triggers Families policy requirements (COPPA / GDPR).
RequiredAds Declaration
State whether your app contains ads - including third-party ad SDKs, display, native, and banner ads.
RequiredApp Access
Working demo or login credentials (up to five sets) for any gated functionality, so reviewers can get in.
If login-gatedAccount & Data Deletion
If users can create an account, you must offer account deletion in-app and via a public web URL, and let them request deletion of their data.
If accounts
Click to enlarge
Data safety, precisely: every app published on Google Play - on the closed, open, or production track - must complete the Data safety form. Internal-testing-only apps are exempt. Apps that collect no data still complete the form and link a privacy policy indicating no collection or sharing. An April 10, 2025 update clarified that Android ID must be declared as a device identifier and tightened the definition of data "sharing."
If any part of your app is behind a login, you must give reviewers working credentials in App access (up to five sets). Invalid, expired, or missing credentials are a classic rejection cause - the reviewer literally cannot see your app, so they reject it. Double-check the login works before you submit.
Category-Specific Declarations (Know If One Applies to You)
Depending on what your app does, you may hit additional declarations. The notable 2026 ones:
- Health apps: the Health Content and Services policy adds medical-device labeling, a disclaimer requirement for non-regulated health apps, migration of health apps to a verified organization account by January 28, 2026, and granular Android 16 health permissions.
- AI-Generated Content policy: generative-AI apps must prevent offensive output, with stricter labeling and moderation since January 2025.
- Photo and Video Permissions policy (actively enforced): request broad photo and video access only when your core feature genuinely needs it - otherwise use the system photo picker. Updated Location permission rules apply as well. A separate Contacts permissions policy follows later, enforced October 28, 2026 and only for apps targeting API 37 or higher.
- High-risk Permissions Declaration Form: required for sensitive access such as SMS or Call Log, plus the Advertising ID declaration.
- Other categories: News & Magazines, Financial Services, Government apps (organization accounts only), and COVID-19 contact-tracing or status declarations.
Step 6: Closed Testing - 12 Testers for 14 Days
For most new developers, this is the wall. Per Google's official policy, a personal account created after November 13, 2023 must run a closed test with a minimum of 12 testers opted in for at least the last 14 continuous days before applying for production access. Organization accounts are exempt, and so are accounts created before that date.
If you have read that the number is 20, that is outdated. Per the Android Developers Blog: "starting today, we're requiring 12 instead of 20 testers for personal developer accounts." The reduction took effect December 11, 2024, keeping the same 14-day duration, after feedback that 20 testers was tough for smaller developers.
Click to enlarge
The Three Testing Tracks (Only One Counts)
Google offers three tracks, and new developers constantly confuse them. Internal testing feels like the obvious quick option, but it does not satisfy the requirement. Only closed testing does.
Internal
Up to 100 testers, ready in minutes.
Closed
A controlled group you invite.
Open
Anyone can join and give feedback.
You add tester emails (via email lists or Google Groups) to your closed track and share the opt-in URL - but each tester must click the link and actively join. Merely adding an email does not count. Testers who opt in, test for fewer than 14 days, then opt out also do not count, because the 14 days must be continuous. This single misunderstanding resets more 14-day clocks than anything else.
At the production application, Google evaluates two things: your tester count (at least 12) and your tester engagement. Their own examples of why they require continued testing include "not having 12 testers opted-in to your closed test, or your testers not being engaged with your app during your closed test." In other words, 12 names on a list is not enough - those testers have to actually use the app.
The Most Effective Way to Pass: Real, Opted-In Testers
Every other requirement in this guide is something you control directly. This one needs 12 real people on real Android devices, opted in and active for 14 unbroken days - which is exactly where solo developers stall. The dependable way to clear it is to bring in real testers who are guaranteed to show up and stay active.
Step 7: The Production Access Questionnaire
Once you meet the closed-testing criteria, a personal account does not flip straight to production - you click "Apply for production" on the Dashboard and answer a questionnaire. You will see this described online as a "10-question form." Ignore that framing: Google updates the wording, and the reliable way to understand it is as three sections, not a fixed question count.
About your closed test
- How easy it was to recruit testers
- How testers engaged with the app
- Whether usage matched real production use
- A feedback summary and how you collected it
About your app or game
- Core functionality and features
- What the app actually does
- Expected installs in the first year
Production readiness
- What you changed based on testing
- How you decided the app is ready
- Why it is production-quality now
Review time: Google says this "usually takes 7 days or less, but may occasionally take longer." Answer with specifics from your actual test - vague, generic answers ("we tested it and it works") are a known way to get sent back for more testing. If you want the exact phrasing reviewers respond to, see our production access questionnaire answers guide.
Review and the Real End-to-End Timeline
There are actually two reviews near the finish line: the production-access review after your questionnaire, and the final app review of the release itself. Google processes standard reviews "as soon as possible," but warns that "certain apps may be subject to extended reviews, which may result in review times of up to 7 days or longer in exceptional cases." Apps targeting children, or those that submitted inaccurate target-audience answers, tend to get the more thorough look.
So how long does the whole thing really take for a brand-new personal account? Here is the realistic stacked timeline, with the overlaps that smart developers exploit:
What Actually Delays First-Timers
The total balloons when one of these hits. Almost all are avoidable:
- Incomplete or slow identity verification - started too late, blocking everything else.
- Weak or missing Data safety declarations - the form is mandatory on testing tracks too.
- Invalid reviewer login credentials in App access - the reviewer cannot get in, so they reject.
- Store listing or screenshots that do not match the real app's functionality.
- Slow tester recruitment or low engagement during the 14-day closed test.
- Vague production-access answers that read as generic and trigger "more testing required."
Pre-Submission Readiness Check
2025-2026 Changes Recap (Quick Reference)
If you only skim one section, make it this one. These are the changes that catch developers who learned the process a year or two ago:
Target API 36 required for new submissions
API 35 is the floor today; API 36 (Android 16) becomes mandatory for new apps and updates.
Aug 31, 2026Android Developer Verification enforcement
Begins in Brazil, Indonesia, Singapore, and Thailand; global in 2027. Affects sideloaded apps too.
Sept 30, 2026Icon 30% dynamic corner radius
Upload a full square; Google masks corners at 30%. Keep key art in a ~15-18% safe zone.
Spec updated Jun 15, 2026Health apps need an organization account
Health Content and Services policy: medical-device labeling, disclaimers, and Android 16 health permissions.
Migrate by Jan 28, 2026AI-Generated Content policy
Generative-AI apps must prevent offensive output, with stricter labeling and moderation.
Since Jan 2025Photo, Video, Location & Contacts permissions
Photo and Video permissions and updated Location rules are enforced now. A new Contacts permissions policy follows for apps that target API 37 or higher.
Contacts: Oct 28, 2026Data safety: Android ID and "sharing"
Android ID must be declared as a device identifier, and the definition of data "sharing" was tightened.
Apr 10, 2025Closed testing dropped from 20 to 12 testers
Personal accounts now need 12 (not 20) testers for the same 14 continuous days.
Dec 11, 2024Account Transfer policy
Ownership must move through the official "Transfer ownership" workflow in Play Console.
In effectExternal-link fees (post-Epic)
Play Console updates introduced fees for linking to external payments or alternative stores. Only matters if you use external billing.
Dec 2025Watch: Google's Official Policy Update (PolicyBytes, April 2026)
Google's Developer Experience team breaks down recent policy changes in its PolicyBytes series, and the April 2026 episode is the official source for several items above - two brand-new policies (Contacts permissions and Account transfers) and two clarifications (age-restricted content and location permissions). Here is the video, with a plain-English breakdown underneath.
PolicyBytes: April 2026 policy updates
Official Google Play channel: new Contacts and Account transfer policies, plus age and location clarifications.
New: Contacts permission policy
Google added a restricted-permissions section that pushes minimum-scope alternatives - use the Android Contact Picker (and tools like ShareSheet) instead of requesting raw access to personal data. The specific rule: if your app targets Android 17 (API 37) or later, you may only use the READ_CONTACTS permission when the Contact Picker genuinely cannot support your core feature, and you must file a Play Console declaration explaining why. Enforcement lands October 28, 2026.
New: Account transfer policy
Every ownership change must now go through the official Transfer ownership flow in Play Console (Users & Permissions → Manage → Make account owner). Requirements differ for individual vs organization accounts, and the incoming owner confirms by email and may need to verify a payments profile or organization details. It exists to stop account takeovers - both parties are responsible during a transfer - and buying, leasing, or selling accounts on third-party marketplaces is explicitly prohibited.
Clarified: age-restricted content (dating features)
If dating is not your app's core purpose but you include a dating feature, a general audience can still download the app - provided you have a strong age restriction (an age check) that keeps minors out of that feature. But if your app's core functionality is dating or matchmaking, you must block minors entirely by selecting the right age group in the Target Audience and Content section.
Clarified: location permissions (minimum scope)
For one-time, user-initiated precise location, you now have to use the Android location button with the onlyForLocationButton flag in your manifest, rather than holding ACCESS_FINE_LOCATION. For more regular needs, use the location button or COARSE_LOCATION. Google will only approve a full ACCESS_FINE_LOCATION request when neither alternative works - and you complete a mandatory declaration with a clear justification in the developer console.
Why this matters for a new app: these slot straight into the App content declarations you already have to complete. If you request contacts, precise location, or photo and video access, plan for a declaration and a minimum-scope alternative from the start - it is far easier than reworking permissions after a rejection.
Where PrimeTestLab Fits Into All This
Look back at the seven steps. Six of them are paperwork and engineering you control: the account, identity, the build, the listing, the declarations, and the questionnaire. One is fundamentally different - it needs 12 real people on real Android devices, opted in and genuinely active for 14 unbroken days. That single step is where most solo developers stall, and it is exactly what PrimeTestLab handles.
You share your closed testing opt-in link. We handle invitation, opt-in verification, daily engagement monitoring, and full 14-day retention, so one tester dropping out never breaks your streak and resets the clock. 4,500+ apps and counting, at a 99.9% first-attempt success rate across 120+ countries.
PrimeTestLab covers the tester requirement - the 12 opted-in, 14-day-active part. It does not file your declarations, pick your account type, or pass the app review for you. The winning combination is your finished app and complete listing plus 12 real testers for the full 14 days, so the closed test is never the reason you get held up.
Current Packages
Frequently Asked Questions
Bottom Line
Summary
Publishing your first Android app in 2026 is a sequence: create the account ($25 once), pass identity verification, build a signed AAB at API 35 today (API 36 from Aug 31, 2026), complete the listing and app content declarations, and - on a personal account - clear the 14-day, 12-tester closed test before the production questionnaire and final review. Budget 3 to 5+ weeks, start the slow steps (identity, D-U-N-S, the closed test) first, and watch the two 2026 shifts: API 36 and Android Developer Verification. The one step you cannot do solo is the closed test - that is what PrimeTestLab covers, so testing is never your bottleneck. See pricing plans →