Text: ‼️🚨 ALARMING: Google now treats privacy as suspicious behavior by default. Users of GrapheneOS, CalyxOS, /e/OS, and other deGoogled Android phones are being locked out of millions of websites unless they install the exact Google Play Services software they deliberately removed. GrapheneOS is recommended by the EFF and used by journalists, lawyers, and activists in high-risk environments. The audience most likely to read Google's data practices and refuse its terms is now flagged as fraudulent for that exact decision. What happened?: ▪️ Google announced "Cloud Fraud Defense" at Cloud Next on April 22-23, 2026, branding it "the next evolution of reCAPTCHA." Existing reCAPTCHA customers were auto-migrated. ▪️ When the system flags traffic as suspicious, the old click-the-bus puzzle is gone. Users get a QR code instead. ▪️ Scanning the QR code requires Google Play Services running on the device. Internet Archive snapshots show this requirement has been live since at least October 2025, silently rolled out for 7 months before anyone noticed. ▪️ No Play Services = no QR scan = locked out. The bigger picture: ▪️ Google already tried this in 2023. It was called Web Environment Integrity (WEI), and it would have let Google decide which devices were "real enough" to access the web. Standards bodies and the public pushed back hard, and Google killed it. Three years later, the same idea is back, just hidden behind a QR code instead of a browser feature. ▪️ reCAPTCHA runs on millions of websites. Every developer who keeps using it is now, by default, telling deGoogled Android users they're not welcome...

the terms are acceptable. i only visit websites that dont enforce that shit

I think this was an inevitability in this timeline: we build a parallel internet. And one day, the legacy internet will become obsolete.

convenience for privacy and other stuff... no thanks! fuck google and co!

yeah, and it's up to us, refuseniks to hasten the outflow and demise of "da goog" (goog, et. al)

Why scanning the QR code requires Google Play Services running on the device? And what's in the QR code?

I don't have enough info. I suppose locally-ran Play Services sign a challenge from the QR with a local key issued by da goog, and sent to a remote endpoint with a proof. Would be good to ddos da goog identity services. Maybe we'll see state-level attackers attacking their counterparts.