Google tied reCAPTCHA to Play Services, depriving Android users without them of the ability to complete identity verification.

Short summary

Google tied a new version of reCAPTCHA to its closed Google Play Services. Android users without “de‑googlified” systems are now automatically rejected on millions of sites during verification. This change appeared in 2025, but the company did not disclose it until media coverage.

What changed?
The old reCAPTCHA used picture puzzles (or audio). Now suspicious activity requires scanning a QR code. Verification worked without third‑party Google services. To scan you need Play Services running in the background and sending data to Google servers. If Play Services is not running, verification is impossible. This means any Android user who refuses to install Google services (for example, for privacy reasons) is automatically blocked.

How did it happen?
1. Public announcement – at Cloud Next on April 23 Google presented an expanded *Google Cloud Fraud Defense* system but did not mention the tie‑in with Play Services.
2. Testing – in October 2025 an Internet Archive snapshot already showed a requirement for version 25.39.30, which includes the new QR code check.
3. Discovery – a user on r/degoogle noticed the change, and PiunikaWeb and Android Authority posts drew public attention.

Thus Google introduced this dependency at least seven months before it became known to the wider audience.

Why is this important?
Platform Requirements
Android (with Play Services) reCAPTCHA works fine
Android (without Play Services) verification fails – user is blocked
iOS 16.4+ reCAPTCHA works without installing any Google software

*Distortion* is obvious: only Android users who refuse Google services face a limitation. If it were about security, the requirement would apply to all mobile OSes.

What this means for users
- Loss of access to millions of sites that use reCAPTCHA.
- Violation of privacy principles: users who consciously declined Google services now must use closed software to access ordinary web content.
- Precedent: verification becomes a prerequisite for accessing any site, opening the door for further control by large tech companies.

What developers need to know
1. Audience awareness – if your site targets Android users without Play Services (e.g., in privacy‑conscious markets), they will be automatically blocked.
2. Alternatives – consider implementing more flexible verification methods or providing alternative ways to pass reCAPTCHA for this group.
3. Communication – inform users why Play Services is required and what data is transmitted.

Conclusion
Google made access to millions of sites dependent on the presence of closed software on Android devices. This creates a new barrier for privacy‑concerned users and raises questions about control over mobile ecosystems. Developers should take these changes into account when choosing bot‑protection tools.