Google’s new reCAPTCHA system restricts access to the open web

Google’s latest reCAPTCHA changes are drawing backlash from privacy advocates and developers of alternative mobile operating systems, who argue the system effectively locks users out of websites unless they use Google-approved devices and software.

The controversy centers on Google’s new “Cloud Fraud Defense” platform, announced during the company’s Cloud Next event held on April 22–23, 2026. Google described the service as the next evolution of reCAPTCHA, with existing reCAPTCHA customers reportedly migrated automatically to the new system. Instead of presenting users with traditional image-based CAPTCHA puzzles, the platform can now display a QR code verification challenge when traffic is flagged as suspicious.

Critics say the problem is that scanning those QR codes requires either Google Play Services on Android or a modern iPhone capable of Apple’s equivalent attestation mechanisms. Users running privacy-focused Android operating systems such as GrapheneOS, CalyxOS, and /e/OS, which intentionally remove Google services, may be unable to complete verification and therefore lose access to websites protected by reCAPTCHA.

Multiple posts on X highlighted the behavior, including warnings from privacy-focused cloud storage provider MEGA and the GrapheneOS project itself. MEGA stated that users without a “certified device” could no longer verify via the QR workflow and warned that Google may eventually remove the remaining fallback methods accessible via small icons beneath the verification prompt.

GrapheneOS, a hardened Android operating system widely recommended by privacy and digital rights organizations, including the Electronic Frontier Foundation (EFF), described the change as part of a broader industry push toward hardware-based attestation. The project argued that both Google and Apple are gradually building systems that allow websites and apps to verify whether users are running approved hardware and operating systems before granting access.

According to GrapheneOS developers, Google’s Play Integrity API and Apple’s App Attest framework are increasingly being integrated into online services under the banner of fraud prevention and security. While the systems are marketed as anti-abuse tools, critics argue they also provide Apple and Google with powerful control over which devices can access large portions of the internet.

The developers also linked the new reCAPTCHA verification flow to Google’s abandoned Web Environment Integrity (WEI) proposal from 2023. That proposal would have introduced browser-level attestation APIs capable of determining whether a device and browser environment met specific trust requirements. Following strong criticism from browser vendors, privacy advocates, and standards groups, Google shelved the initiative. They now argue that reCAPTCHA Mobile Verification achieves a similar outcome indirectly through QR-based device checks.

GrapheneOS claims the technology disproportionately impacts privacy-conscious users, journalists, activists, lawyers, and others who intentionally avoid Google services. The project also noted that Play Integrity currently blocks GrapheneOS despite its security-focused design, while still allowing older certified Android devices that may no longer receive security patches.

Google has not publicly framed the feature as a hardware attestation requirement, instead presenting it as a fraud prevention enhancement designed to improve verification reliability and reduce bot abuse.