Google Tests QR Code reCAPTCHA, Raising Privacy Concerns for Android Users

​Google is testing a new reCAPTCHA system that may require users to scan a QR code with their mobile device. This change could impact millions of Android users and raise privacy concerns. Instead of identifying images, users may need to scan a QR code that links their website visit to their phone through Google Play Services.

Key Highlights

• Google is testing a QR code-based reCAPTCHA system for website verification.
• Android users must scan a QR code linked to Google Play Services version 25.41.30 or higher.
• Over 5.3 million companies use Google reCAPTCHA, affecting millions of website visits.
• De-Googled phones without Play Services may not pass the new verification process.

How the QR Code reCAPTCHA Works

The new system replaces traditional image-based CAPTCHAs. When visiting certain websites, users will be prompted to scan a QR code using their phone. This process uses Google Play Services installed on Android devices to verify the user's identity. According to a Reddit post by user "gib_me_gold," Google appears to be developing this next-generation reCAPTCHA. Screenshots shared online show the system in action and suggest that it may soon become widespread.

Google has not provided full details on how the system works. However, a Google support page indicates that Android users need Google Play Services version 25.41.30 or higher to complete verification. This means that scanning the QR code will link the website visit to the user's Android phone, regardless of the browser or Google account status. If Google Play Services is active, the phone is usually signed in to a Google account.

Potential Privacy and Access Issues

Over 5.3 million companies use Google reCAPTCHA, according to Landbase. This new method could make it difficult for Android users to access millions of websites without connecting their phone to their web activity. While it is unclear if Google will share Play Services details with the websites, the company itself may receive this information.

For iPhone users, the support page mentions that a reCAPTCHA app can be downloaded to complete verification. This process does not require Google Play Services on iOS devices.

There is a significant issue for users of de-Googled phones. Devices running custom ROMs like GrapheneOS do not include Google Play Services. These users may not be able to pass the QR-based verification, potentially blocking access to many websites. This change could affect those who use Android devices without Google apps for privacy reasons.

Background and Implementation Timeline

Reports indicate that Google has been preparing this mobile verification method since October 2023. Conceptual illustration of the new Google QR code reCAPTCHA on a smartphone screen, representing the link between website verification noted that an Internet Archive snapshot from October 2023 showed a support page listing a Play Services requirement, then at version 25.39.30. The system appears to be part of a broader effort to improve bot detection, but it has sparked debate about privacy and access for users who avoid Google services.