FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

hCaptcha

EssentialOfficial website

hCaptcha is a privacy-focused CAPTCHA service by Intuition Machines designed as a GDPR-friendly alternative to Google reCAPTCHA. Unlike reCAPTCHA, hCaptcha does not share challenge data with Google for advertising purposes, provides clear GDPR contractual terms, and offers a privacy-pass mode that minimises data processing. Legitimate interest supports its use for bot prevention without requiring consent. It is a drop-in reCAPTCHA replacement widely used by privacy-conscious organisations.

Block hCaptcha until consentScan my site
Overview

What does hCaptcha do?

What is hCaptcha?

hCaptcha is a CAPTCHA service developed by Intuition Machines as a privacy-focused alternative to Google reCAPTCHA. Like reCAPTCHA, it presents visual challenges (image selection grids) or invisible challenges to verify users are human. Unlike reCAPTCHA, hCaptcha does not share challenge or risk data with Google for advertising purposes. It processes the minimum data necessary for bot detection and provides clearer GDPR contractual terms.

Why hCaptcha is more GDPR-friendly than reCAPTCHA

The primary GDPR concern with Google reCAPTCHA is that challenge data may be used by Google for advertising and profiling purposes beyond bot detection. hCaptcha contractually commits to using challenge data only for security purposes. It provides a GDPR-compliant DPA, offers a privacy-pass mode that reduces data collection further, and does not read or influence existing Google account cookies. Legitimate interest is a more supportable legal basis for hCaptcha than for reCAPTCHA precisely because of this narrower data use.

Drop-in reCAPTCHA replacement

hCaptcha provides a drop-in replacement for Google reCAPTCHA v2 with a compatible JavaScript API. Replacing reCAPTCHA with hCaptcha typically requires only a script URL change and a new site key. The visual challenge interface is similar to reCAPTCHA v2. For invisible verification (reCAPTCHA v3 equivalent), hCaptcha's Enterprise tier provides score-based invisible challenges.

Practical compliance steps

Sign the hCaptcha DPA and accept US data transfer under SCCs. Replace Google reCAPTCHA script tags with hCaptcha equivalents. Document the legitimate interest basis for bot prevention in your RoPA. Disclose hCaptcha in your privacy policy: bot prevention service, US data transfer, SCCs, and minimal data processing scope.

Compliance

hCaptcha and the GDPR

Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) for bot prevention and security. hCaptcha is designed to minimise personal data collection. Unlike Google reCAPTCHA, hCaptcha does not share challenge data with advertising platforms. The privacy-first design supports a legitimate interest basis without consent.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, SCCs for US transfers. hCaptcha provides a GDPR-compliant DPA and is designed as a privacy-respecting reCAPTCHA alternative.

Impact assessment (DPIA)

A DPIA is generally not required for hCaptcha standard deployments. Its privacy-minimising design and absence of advertising data sharing significantly reduce privacy risk compared to Google reCAPTCHA.

Sample text for your banner

This website uses hCaptcha to protect forms from spam and bots. hCaptcha processes minimal technical data for security purposes under legitimate interest. Data is processed in the US under Standard Contractual Clauses. See hCaptcha's privacy policy for details.
Cookies and trackers

What hCaptcha sets and contacts

Tracking method
CAPTCHA challenge widget, privacy-focused bot detection, no Google data sharing, first-party data processing, proof of work challenges
Server location
United States (Intuition Machines, Inc. / hCaptcha infrastructure)
Cookieless mode available
Yes
Data transferred outside the EU
hCaptcha is operated by Intuition Machines Inc. (US). Challenge data and risk signals are processed on US infrastructure. EU personal data transfers require Standard Contractual Clauses. However, hCaptcha is explicitly designed to minimise personal data collection and provides a GDPR-compliant DPA.

Cookies set (1)

NameTypeDurationPurpose
hmt_idsessionSessionhCaptcha session identifier maintaining challenge state during bot verification, minimal data footprint

Third-party domains contacted (2)

  • hcaptcha.com
  • newassets.hcaptcha.com
Questions

Frequently asked questions about hCaptcha

Can't find your question? Write to us, we answer fast.

Why is hCaptcha more GDPR-friendly than Google reCAPTCHA?

hCaptcha contractually restricts data use to security purposes only: it does not share challenge data with advertising platforms. reCAPTCHA data may be used by Google for advertising. This makes legitimate interest more defensible for hCaptcha and reduces the privacy risk profile significantly.

Does hCaptcha require consent?

Generally no. hCaptcha's data processing for bot prevention can be justified under legitimate interest (Art. 6(1)(f)) as a necessary security measure. The legitimate interest balancing test supports bot prevention as proportionate to the security benefit. No consent banner is typically needed for hCaptcha.

Does hCaptcha transfer data outside the EU?

Yes. hCaptcha is operated by Intuition Machines (US). Challenge data is processed on US infrastructure. SCCs are required. Sign the hCaptcha DPA. Disclose the US transfer in your privacy policy.

What cookies does hCaptcha set?

hCaptcha sets hmt_id (session identifier) for maintaining the challenge state. Unlike reCAPTCHA, hCaptcha does not set long-lasting tracking cookies or read existing Google account cookies. The data footprint is minimal.

Is hCaptcha a drop-in replacement for Google reCAPTCHA?

For reCAPTCHA v2, yes. hCaptcha provides a compatible JavaScript API and visual widget. Replacing reCAPTCHA v2 with hCaptcha typically requires only changing the script URL and site key. For reCAPTCHA v3 (invisible, score-based), hCaptcha Enterprise provides equivalent invisible challenge capabilities.

Does hCaptcha offer an accessibility-friendly option?

Yes. hCaptcha provides a "privacy pass" mode that allows users who have previously verified to bypass the visual challenge, and audio challenges for visually impaired users. Accessibility was specifically designed into the challenge system.

How do I disclose hCaptcha in my privacy policy?

State: that forms are protected by hCaptcha for bot prevention, that hCaptcha processes minimal technical data (browser fingerprint, IP, challenge interaction) for security analysis, that this is processed under legitimate interest, that data is transferred to Intuition Machines in the US under SCCs, and link to hCaptcha's privacy policy.

What other CAPTCHA alternatives exist besides hCaptcha?

Cloudflare Turnstile: CAPTCHA-free, minimal data, free, strong privacy design. Arkose Labs: enterprise-level bot protection. Friendly Captcha: EU-hosted (Germany), proof-of-work based, no data sent to third parties. For maximum GDPR simplicity, Friendly Captcha (EU-hosted) or Cloudflare Turnstile are the strongest alternatives.

Same category

More services: Security

See the whole category

SnapHost

SnapHost is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SnapHost integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SnapHost helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Castle

Castle is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Castle integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Castle helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Accertify

Accertify is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Accertify supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Accertify ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Slider Captcha

Slider Captcha is an image management and optimization solution that helps websites deliver high-quality visual content with optimal performance. It provides automatic compression, format conversion, and responsive delivery for fast page loads. Slider Captcha supports lazy loading, CDN distribution, and gallery creation, enabling businesses to showcase visuals beautifully while maintaining excellent Core Web Vitals scores and search engine rankings.

Essential

CopyPoison

CopyPoison is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. CopyPoison is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, CopyPoison offers reliable solutions that scale with organizational needs and evolving web standards.

Essential

Trezor

Trezor is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Trezor supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Trezor ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site