F-Droid warns that Google's Android Developer Verification (ADV) process functions as undetectable malware on devices running Android 8 or higher. The trojan allegedly operates as a system service with root privileges under the guise of 'Android Developer Verifier,' remaining dormant until remote activation. According to the open-source repository, Play Protect serves as the transmission vector for this malicious code, affecting an estimated 4 billion Android devices worldwide.

The program's stated purpose—preventing malware recidivism—faces criticism for requiring developers to surrender personal information, upload identification, and accept terms granting Google unilateral power to define 'malware.' Without clear definitions in the Android Developer Console Terms of Service, F-Droid argues Google can designate any software as malicious based on business incentives. This approach contradicts the open-source model of security through transparency that F-Droid has championed for 16 years.

Opposition spans over 70 organizations including the EFF, FSF, and ACLU, with hundreds of thousands signing petitions against ADV. Despite Google claiming 99% developer registration, critics note this reflects auto-opt-in from existing Play Store agreements rather than genuine acceptance. The backlash reflects fundamental concerns about centralized control over software definitions and user freedoms.

Initial rollout targets Brazil, Indonesia, Singapore, and Thailand on September 30, with global expansion planned through 2027. F-Droid frames this as Google positioning itself as the sole gatekeeper for app legitimacy, potentially threatening ad-blocking software and other independently-developed applications that compete with Google's commercial interests.