Google's reCAPTCHA v2 service no longer functions correctly on Android devices that have been de-Googled — that is, devices running custom ROMs or configurations that strip out Google's proprietary services. The failure means these users are unable to pass the "I'm not a robot" challenge, leaving them exposed to automated bot attacks on websites that rely on reCAPTCHA for protection.
What's happening
reCAPTCHA v2 works by collecting device fingerprinting data — including signals from Google's SafetyNet API — to determine whether a user is human. On de-Googled Android devices, SafetyNet is absent or disabled. Google's server-side validation then fails to verify the device's integrity, causing the reCAPTCHA challenge to either loop indefinitely or silently mark the user as a bot.
Who is affected
The issue affects users running custom Android distributions such as LineageOS, GrapheneOS, CalyxOS, or any other build that does not include Google Mobile Services (GMS). Estimates suggest this represents roughly 1% of global Android users — a small but vocal minority that includes privacy-conscious individuals, developers, and security researchers.
The practical impact
For affected users, the consequences are immediate:
- They cannot complete reCAPTCHA challenges on websites that use v2, including many forums, e-commerce sites, and login portals.
- Their traffic may be blocked or rate-limited as if it were coming from a bot.
- They lose access to services that rely on reCAPTCHA as a gatekeeper, even if they are legitimate human users.
Why it matters
This is not a bug in the traditional sense — it is a design consequence. Google's reCAPTCHA is tightly integrated with its proprietary SafetyNet API, which is only available on devices that pass Google's compatibility tests and include GMS. De-Googled devices intentionally opt out of this ecosystem, and Google's server-side validation has no fallback mechanism for devices that lack SafetyNet.
Workarounds
There is no official fix from Google. Users have a few partial workarounds:
- Use a browser extension that bypasses reCAPTCHA (e.g., Buster for Chrome/Firefox, though its effectiveness varies).
- Switch to a privacy-respecting CAPTCHA alternative on the server side, such as hCaptcha or Cloudflare Turnstile — but this requires website operators to change their implementation.
- Accept that some sites will be inaccessible and seek alternative services that do not rely on Google's CAPTCHA.
Bottom line
Google's reCAPTCHA v2 has effectively become a compatibility gate for de-Googled Android users. The 1% of users who run such devices now face a degraded web experience, with no clear path to resolution from Google. For website operators, this is a reminder that relying on a single vendor's CAPTCHA system can inadvertently lock out a segment of privacy-conscious users.