ALTCHA

What ALTCHA is and what it does

ALTCHA is an open source captcha alternative developed by Daniel Regeci and the BAU.PLUS team in Slovakia. Instead of relying on behavioural tracking, fingerprinting or solving image puzzles, it uses a proof of work challenge that the visitor browser computes locally before the form is submitted. The server then verifies the signed token and accepts or rejects the submission, blocking the vast majority of spam bots without ever profiling the human user.

Data and cookies collected by ALTCHA

In its default configuration ALTCHA does not set any cookies, does not run device fingerprinting and does not build behavioural profiles. The only data processed are the visitor IP address (which is unavoidable for any HTTP request to the verification endpoint), the proof of work challenge and the short lived signed token returned by the browser. When the hosted variant on eu.altcha.org or us.altcha.org is used, a temporary altcha_session value may be kept server side for rate limiting, but no client side identifiers are persisted on the device.

GDPR and ePrivacy implications

Because ALTCHA performs only local computation in the browser and a single signed exchange with the verification endpoint, it falls comfortably within the strictly necessary exception of Art. 5(3) ePrivacy as transposed into national laws such as the German TDDDG. There is no profiling within the meaning of Art. 22 GDPR, no special category data and, when the EU endpoint or a self hosted instance is used, no transfer of personal data to third countries. The remaining GDPR obligations are limited to transparency in the privacy notice and a brief legitimate interest assessment.

Consent requirements and legal basis

In most deployments prior consent is not required. ALTCHA can be loaded under the ePrivacy strictly necessary exception because it is essential to protect the requested form submission against abuse, and the processing relies on Art. 6(1)(f) GDPR (legitimate interest in fraud and abuse prevention) or Art. 6(1)(b) GDPR (performance of the contract represented by the form). It should be placed in the strictly necessary category of the cookie banner, with a short explanation in the privacy notice. Consent only becomes relevant if the deployment is bundled with optional analytics or risk scoring features that go beyond pure spam protection.

Cross border transfers and practical compliance steps

When ALTCHA is self hosted or used through the eu.altcha.org endpoint, no personal data leaves the EU, which removes the Chapter V GDPR transfer problem entirely. If the publisher selects us.altcha.org, the processing relies on Standard Contractual Clauses and a transfer impact assessment, and that choice should be reflected in the privacy notice and records of processing. Practical steps: document the LIA, prefer the EU or self hosted variant, expose ALTCHA in the privacy notice under security, list it under strictly necessary in the cookie banner, and review the configuration each year to confirm that no optional tracking features have been enabled.