#recaptcha

background under the cut:

source 1

source 2

Google has introduced a new recaptcha at cloud next around April 22nd

It was called "Cloud Fraud Defense"

“branding it "the next evolution of reCAPTCHA." Existing reCAPTCHA customers were auto-migrated.”

Instead of the usual puzzle you would get, there is a QR code

The Google cloud website says that this upgrade is to protect against the evolving world of automation

“The agentic web — where autonomous AI agents reason, plan, and execute complex transactions using the open web and industry standard protocols — aims to create an autonomous customer experience.

While these agents can significantly enhance online interactions, they also introduce new abuse and fraud vectors, creating unique challenges for security platforms.”

“Fraud Defense is a comprehensive platform designed to verify the legitimacy of bots, humans, and AI agents, providing businesses with the intelligence needed to secure their digital interactions and commerce.”

“reCAPTCHA will continue to be the core bot defense pillar of the broader Fraud Defense platform.

Existing reCAPTCHA customers are automatically Fraud Defense customers, with no migration required, no action needed, and no change to pricing.

Your existing site keys and integrations remain exactly as they are today.”

the important part!

The QR code needs “Google Play Services running on the device.

Internet Archive snapshots show this requirement has been live since at least October 2025, silently rolled out for 7 months before anyone noticed.”

“No Play Services = no QR scan = locked out.”

Which means as this Twitter account points out

“Users of GrapheneOS, CalyxOS, /e/OS, and other deGoogled Android phones are being locked out of millions of websites unless they install the exact Google Play Services software they deliberately removed.”

Google has tried this before with Web Environment Integrity (WEI)

“and it would have let Google decide which devices were "real enough" to access the web. Standards bodies and the public pushed back hard, and Google killed it.”