Last week, I tried to sign up for a new email account. What followed was a 15-minute gauntlet of head rotations, phone number confirmations, and a CAPTCHA that made me identify traffic lights in a blurry photo of a parking lot. I failed twice. The app asked me to install a second app. I gave up. I wasn’t a bot. I was a human being made to feel like one.
You’ve felt it too. Every site now demands you prove your humanity—not by doing something human, but by jumping through hoops designed by machines. Every time you prove you’re human, you’re teaching machines how to replace you. That’s not paranoia. That’s the architecture of the modern web.
For years, we blamed the bots. Spam, scraping, fraud—the bots ruined it for everyone. So the industry fought back. CAPTCHAs evolved from squiggly letters to traffic light quizzes. Then came 2FA, device attestation, and the dreaded “rotate your head” verification. Banking apps force updates that have nothing to do with security. Websites block copy-paste as if your clipboard is a weapon. And Cloudflare sits in the middle, deciding who gets through and who doesn’t.
Here’s the twist nobody’s talking about: The ‘bot problem’ isn’t the problem—it’s the excuse. The real agenda is a slow, coordinated push toward a centralised web identity. A world where your device is your passport, and you can’t access anything without being tracked, verified, and surveilled. Cloudflare, Google, Apple—they’re building the infrastructure for a web where anonymity is dead. Where every click is stamped with your digital fingerprint.
I saw this firsthand. I run a small blog. One day, Cloudflare decided I was an adversary. Suddenly, half the internet was behind a wall I couldn’t climb. No explanation. No appeal. Just a gatekeeper deciding my humanity was in question. Cloudflare holds the keys to the internet. And they’re not giving them back.
This isn’t about security. It’s about control. Every time you rotate your head for a bank app, you’re training the system to recognize your face. Every time you enter a code from your phone, you’re linking that number to your browsing history. Every time you clear a CAPTCHA, you’re letting a machine decide what a human looks like—and it’s not you.
Here’s what I know: The web doesn’t hate you. It’s just been designed to treat you like a criminal until you prove otherwise. And when you finally prove it, you’ve given away the one thing that made the internet revolutionary: the ability to be anonymous, to be wrong, to explore without a leash.
So what do we do? Stop accepting the degradation. Refuse the head rotation. Click away from sites that demand your phone number. Use ad blockers, but also use your voice. Because the next time a website asks you to prove you’re human, remember: they’re not testing you. They’re training themselves to replace you.
FAQ
Q: Aren't CAPTCHAs and 2FA necessary to stop bots?
A: Yes, but the current approach is a sledgehammer. The industry has conflated inconvenience with security. The real solution isn't more hoops—it's better backend detection, not front-end harassment. The trend toward device attestation and universal identity is a choice, not a necessity.
Q: What can I do today to protect my privacy?
A: Use privacy-focused browsers (Brave, Firefox), enable ad-blockers, avoid sites that force you to install apps, and consider using temporary email services for sign-ups. Most importantly, refuse to comply with invasive verification—rotate your head? No. Unnecessary phone number? No. Your discomfort is data.
Q: Isn't a centralized web identity actually more secure?
A: It's more secure for the gatekeepers, not for you. Centralized identity means one point of failure—if Cloudflare or Google decides you're a risk, you lose access to huge swaths of the internet. It also means surveillance becomes mandatory. The old web was messy and insecure, but it was free. This new 'secure' web is a prison with a nice lock.