Google has a new system called Cloud Fraud Defense, which is the next version of reCAPTCHA, and has started rolling out to users When the system detects risky web activity, it no longer shows the old picture puzzles where you pick out buses or traffic lights. Instead, it displays a QR code that you scan with your Android phone, but to pass the test your phone must have Google Play Services installed and running. This change has been active since October 2025 based on support pages and old web records, and it blocks users of privacy-focused Android phones such as GrapheneOS, CalyxOS, and /e/OS because these phones remove Google services on purpose to provide stronger privacy and security. The result is that millions of websites now treat these privacy phones as risky, so users must either add Google Play Services or stay locked out. This is similar to Google’s 2023 Web Environment Integrity idea that wanted websites to check if devices were trustworthy through Google software. That plan received heavy criticism from developers and privacy groups and was dropped, but the new QR code method does something very similar in a simpler way. Website owners who use this system are now blocking people who chose to remove Google from their phones for better privacy.