Google Broke reCAPTCHA for De-Googled Android Users

Source: Hacker News

Background

Google has tied its next‑generation reCAPTCHA system to Google Play Services on Android. This means anyone running a de‑Googled phone will automatically fail verification when the system decides to challenge them.

The requirement forces Android users to run Google’s proprietary app framework version 25.41.30 or higher just to prove they’re human.

When reCAPTCHA flags what it considers suspicious activity, it abandons the old image puzzles and demands you scan a QR code. That scan requires Play Services running in the background, communicating with Google’s servers. If you’re using GrapheneOS or any other custom ROM that strips out Google’s software, the verification fails.

Google announced the broader system, Google Cloud Fraud Defense, at Cloud Next on April 23, pitching it as a trust platform designed to handle autonomous AI agents and traditional bots alike. What Google didn’t emphasize was the part where proving you’re human now requires submitting to its proprietary surveillance.

Evidence and Timeline

• An Internet Archive snapshot from October 2025 shows the same support page already listing a Play Services requirement at version 25.39.30.
• Google built this dependency quietly for at least seven months before a Reddit user on the de‑Google subreddit flagged it.
• Reporting from PiunikaWeb and Android Authority brought wider attention.

Comparison with iOS

The iOS comparison is revealing because Apple devices running iOS 16.4 or later complete the same verification without installing any additional apps. Google didn’t demand iPhone users install Google software to pass the test. Only Android users who refuse Play Services get locked out. The asymmetry shows that the change is less about security and more about ecosystem control.

Implications for Web Developers

reCAPTCHA sits in front of millions of websites. When Google ties verification to Play Services, it establishes a precedent where accessing basic web content requires running Google’s software and transmitting data to Google’s servers.

Developers adopting this version of reCAPTCHA should understand what they’re choosing. Every site that implements it effectively tells de‑Googled Android users they’re not welcome. While that audience is currently small, it consists of users most concerned about data practices and least likely to accept forced surveillance.