> How adCAPTCHA verifies humans with a strictly necessary security token, why it is generally consent exempt under GDPR and ePrivacy, and compliance tips. > > Canonical: https://www.flowconsent.com/en/services/security/adcaptcha Security # adCAPTCHA Essential · [Official website](https://adcaptcha.com) adCAPTCHA is a privacy friendly human verification tool that sets a strictly necessary security token rather than tracking cookies, so it is generally exempt from consent. [Block adCAPTCHA until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 1 - Third-party domains 3 - Servers United Kingdom and European Union Overview ## What does adCAPTCHA do? ## **What adCAPTCHA is** adCAPTCHA is a human verification and anti bot service that protects forms, logins and checkout flows from automated abuse. It presents a challenge that is easy for people and hard for bots, then issues a token confirming the visitor passed. It is built for European audiences with a privacy first design that avoids advertising and cross site tracking. ## **What data and cookies it sets** Rather than tracking cookies, adCAPTCHA relies on a single strictly necessary security token that confirms a successful verification for the current session. It processes minimal technical signals needed to tell humans from bots, such as challenge interaction and basic request metadata. It does not build advertising profiles or follow visitors across unrelated websites. ## **GDPR and ePrivacy implications** Because the verification token is strictly necessary to provide a security service the user has requested, it falls within the exemption in Article 5(3) of the ePrivacy Directive. The limited personal data involved can be processed under the legitimate interest of fraud prevention and security in Article 6(1)(f) of the GDPR. Data minimisation and transparency remain important even where consent is not needed. ## **Consent requirements** Unlike advertising cookies, the adCAPTCHA security token generally does not require prior consent because it is strictly necessary for a service the visitor explicitly asked for. You should still inform users in your privacy notice that a security check is in place and explain why. If you ever extend the tool beyond its security purpose, reassess whether consent becomes necessary. ## **Data transfers and hosting** adCAPTCHA hosts its verification infrastructure within the United Kingdom and the European Union, so the core security function does not require transfers of personal data to third countries. This European hosting removes much of the transfer risk associated with United States based alternatives. Confirm the current hosting region and data processing agreement in your contract and keep it on file. ## **Practical compliance steps** Describe the security check in your privacy notice and list the strictly necessary token in your cookie policy under necessary cookies. Sign the data processing agreement, confirm the retention period for challenge data and document the legitimate interest assessment. Because it is consent exempt you can load it before the banner, but keep transparency clear so users understand the protection. Compliance ## adCAPTCHA and the GDPR - Legal basis Legitimate interest (Article 6(1)(f) GDPR) for fraud prevention and security, with the security cookie exempt from prior consent under Article 5(3) of the ePrivacy Directive as strictly necessary - Risk level low - Applicable regulations GDPR, UK GDPR, ePrivacy Directive, national cookie laws (TTDSG in Germany, PECR in the United Kingdom) ### Impact assessment (DPIA) adCAPTCHA is a low risk, privacy friendly security tool, so a full data protection impact assessment is usually not required. Still document that the verification token is strictly necessary, that processing relies on legitimate interest for fraud prevention, and that data is minimal and hosted within the United Kingdom and the European Union. Record the short retention of challenge data and confirm that no advertising profiles are built, which keeps the residual risk to data subjects low. ### Sample text for your banner > This site uses adCAPTCHA to verify that you are human and to protect against automated abuse. This security check sets a strictly necessary token and does not track you or build advertising profiles, so it operates without requiring your consent. Details are available in our privacy notice. Cookies and trackers ## What adCAPTCHA sets and contacts - Tracking method Strictly necessary security token and anti bot challenge, no advertising or cross site tracking - Server location United Kingdom and European Union ### Cookies set (1) | Name | Type | Duration | Purpose | | ---------------- | ------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | adcaptcha\_token | Strictly necessary | Session | Stores a security token confirming the visitor passed the human verification challenge, used to prevent automated abuse. It does not track users or build advertising profiles. | ### Third-party domains contacted (3) - `adcaptcha.com` - `api.adcaptcha.com` - `cdn.adcaptcha.com` Questions ## Frequently asked questions about adCAPTCHA Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does adCAPTCHA set? adCAPTCHA sets a single strictly necessary security token that confirms a visitor passed the human verification for the current session. It does not set advertising or tracking cookies and does not build profiles across sites. ### Is consent required to use adCAPTCHA? Generally no. Because the security token is strictly necessary to deliver a protection the visitor requested, it is exempt from prior consent under Article 5(3) of the ePrivacy Directive. You should still describe the security check in your privacy notice. ### What is the legal basis for adCAPTCHA? The limited data is processed under the legitimate interest of fraud prevention and security in Article 6(1)(f) of the GDPR, while the strictly necessary token is exempt from consent under the ePrivacy Directive. ### Does adCAPTCHA transfer data to the United States? No. adCAPTCHA hosts its verification infrastructure within the United Kingdom and the European Union, so the core security function does not require transfers of personal data to third countries. ### Do I need a DPIA for adCAPTCHA? A full data protection impact assessment is usually not required because adCAPTCHA is low risk, processes minimal data and does not profile users. Document the legitimate interest assessment and the strictly necessary nature of the token. ### How do I implement adCAPTCHA compliantly? Add adCAPTCHA to protected forms, describe the security check in your privacy notice and list the strictly necessary token under necessary cookies. Sign the data processing agreement and confirm the short retention of challenge data. ### Are there alternatives to adCAPTCHA? Other CAPTCHA and bot mitigation tools exist, but many rely on United States hosting or tracking signals. adCAPTCHA stands out for its European hosting and privacy first design, which reduces consent and transfer concerns. ### How do I update my cookie policy for adCAPTCHA? List the adCAPTCHA security token under strictly necessary cookies with its purpose and session duration, and explain it supports fraud prevention. Note that it is consent exempt and review the entry whenever the integration changes. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [db-ip](https://www.flowconsent.com/en/services/security/db-ip) [db-ip is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. db-ip supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, db-ip ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/db-ip) [Essential](https://www.flowconsent.com/en/services/security/db-ip) · ### [IBM DataPower](https://www.flowconsent.com/en/services/security/ibm-datapower) [IBM DataPower is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. IBM DataPower integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, IBM DataPower helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/ibm-datapower) [Security](https://www.flowconsent.com/en/services/security/ibm-datapower) · ### [Cloudflare Turnstile](https://www.flowconsent.com/en/services/security/cloudflare-turnstile) [Cloudflare Turnstile is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Cloudflare Turnstile supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Cloudflare Turnstile ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/cloudflare-turnstile) [Essential](https://www.flowconsent.com/en/services/security/cloudflare-turnstile) · ### [Twilio Authy](https://www.flowconsent.com/en/services/security/twilio-authy) [Twilio Authy is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Twilio Authy offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Twilio Authy empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/security/twilio-authy) [Essential](https://www.flowconsent.com/en/services/security/twilio-authy) · ### [MetaMap](https://www.flowconsent.com/en/services/security/metamap) [MetaMap is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. MetaMap supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, MetaMap enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/metamap) [Essential](https://www.flowconsent.com/en/services/security/metamap) · ### [Thawte](https://www.flowconsent.com/en/services/security/thawte) [Thawte is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Thawte supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Thawte ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/thawte) [Security](https://www.flowconsent.com/en/services/security/thawte) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)