To access a website, you now need to open your camera and wave 👋
Yes, Google is testing a new reCAPTCHA that asks you to make hand gestures at your camera instead of clicking traffic lights.
Your browser requests camera access, records a short video of your hand movement, and sends it to Google to verify you're human.
Of course, Google says they don't retain any data. But this is also the company whose entire business model runs on knowing everything about you, so. 🤷
And don't worry, the normal reCAPTCHA methods are still there, for now...
Google has a new system called Cloud Fraud Defense, which is the next version of reCAPTCHA, and has started rolling out to users
When the system detects risky web activity, it no longer shows the old picture puzzles where you pick out buses or traffic lights. Instead, it displays a QR code that you scan with your Android phone, but to pass the test your phone must have Google Play Services installed and running.
This change has been active since October 2025 based on support pages and old web records, and it blocks users of privacy-focused Android phones such as GrapheneOS, CalyxOS, and /e/OS because these phones remove Google services on purpose to provide stronger privacy and security.
The result is that millions of websites now treat these privacy phones as risky, so users must either add Google Play Services or stay locked out.
This is similar to Google’s 2023 Web Environment Integrity idea that wanted websites to check if devices were trustworthy through Google software.
That plan received heavy criticism from developers and privacy groups and was dropped, but the new QR code method does something very similar in a simpler way.
Website owners who use this system are now blocking people who chose to remove Google from their phones for better privacy.