Privacy advocates slam reCAPTCHA update that they say locks out de-Googled phones

Written by Martin Young⁠, Staff Writer. Reviewed by Felix Ng⁠, Staff Editor. Written by Martin Young⁠, Staff Writer. Reviewed by Felix Ng⁠, Staff Editor. Privacy advocates slam reCAPTCHA update that they say locks out de-Googled phonesLatest NewsPublishedMay 11, 2026

Privacy-conscious internet users are being “demoted” from second to third-class netizens, said Bitcoiner Jameson Lopp.

Privacy proponents have criticized Google’s latest updates to its reCAPTCHA system, arguing it has effectively “locked out” millions of websites from Android users running privacy–focused operating systems. 

Google-owned reCAPTCHA is used to verify whether a user is a person, usually by asking them to click on images of a bus or a fire hydrant. 

Google announced “Cloud Fraud Defense” in late April, branding it “the next evolution of reCAPTCHA.”The latest update now presents users with a QR code to verify their humanity, but requires Google Play Services or the Apple equivalent to be running on the device, which isn’t present on “de-Googled” Android phones, such as those running GrapheneOS or CalyxOS.

“They’re directly participating in locking out competition via their own services,” said the GrapheneOS team on Sunday, referring to the increasing use of Apple’s App Attest and Google’s Play Integrity. 

“Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.”

Privacy advocates often use de-Googled mobile operating systems to prevent data harvesting by Google software and have more freedom over what can be installed on their devices.

Backlash as changes impact privacy-focused users 

“Privacy-conscious internet users are being demoted from 2nd to 3rd class netizens,” said Bitcoin security researcher and cypherpunk Jameson Lopp on Sunday. 

“Google now treats privacy as suspicious behavior by default,” cybersecurity outlet International Cyber Digest said. 

The CEO and co-founder of the privacy-focused Brave browser, Brendan Eich, said services shouldn’t ban people from using arbitrary hardware and operating systems in the first place. 

“Google’s security excuse is clearly bogus when they permit devices with no patches for ten years… It’s for enforcing their monopolies via GMS licensing, that’s all.”

Source: Jameson Lopp

Desktop browsers initially targeted

To complete mobile verification, one must use a compatible mobile device that includes Google Play Services version 25.41.30 or greater or iOS version 15.0 or greater, states Google on its website. 

The team at GrapheneOS explained that the move would impact Microsoft Windows or other operating systems not certified by Google or Apple. The prompt is primarily going to be shown on desktop platforms, but could be expanded, it said.

“Their plan requires having a certified Android device or iOS device to pass this on a desktop,” they added. 

Related: Google Chrome’s 4GB AI model shows why browser trust matters for crypto security

“Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web.”

Google engineers spearheaded a controversial proposal in 2023

Google attempted something similar in 2023 with a system called “Web Environment Integrity (WEI),” which would have let the company decide which devices were “real enough” to access the web, wrote International Cyber Digest.

“Standards bodies and the public pushed back hard, and Google killed it. Three years later, the same idea is back, just hidden behind a QR code instead of a browser feature,” they added. 

Magazine: Strategy reveals why they would sell BTC, Trump Media posts loss: Hodler’s Digest

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Google
• Apple
• Privacy
• AI & Hi-Tech

More on the subject

Privacy advocates slam reCAPTCHA update that they say locks out de-Googled phones1 hour agoMartin YoungGoogle Chrome’s 4GB AI model shows why browser trust matters for crypto security May 9, 2026Dilip Kumar PatairyaCoinbase and AWS launch USDC payment rails for AI agentsMay 7, 2026Nate KostarPrivacy advocates slam reCAPTCHA update that they say locks out de-Googled phones1 hour agoMartin YoungGoogle Chrome’s 4GB AI model shows why browser trust matters for crypto security May 9, 2026Dilip Kumar PatairyaCoinbase and AWS launch USDC payment rails for AI agentsMay 7, 2026Nate Kostar