The headline is absolutely wrong, in the keynote they expected to warn about one million users in the first year - not 100 million.

The requirement will go into effect in September 2026 for users in Brazil, Indonesia, Singapore, and Thailand. Google notes how these countries have been “specifically impacted by these forms of fraudulent app scams.” Verification will then apply globally from 2027 onwards.

Interesting side note

seeding boobytrapped .svg files

Oh well, some lines write themselves