FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

MTCaptcha

EssentialOfficial website

MTCaptcha is a CAPTCHA service that protects forms, logins and sign-ups from bots and spam, with an option for invisible verification. The widget loads from MTCaptcha's servers and analyzes the request to tell humans from automated traffic. Since it serves a security purpose, it is often treated as strictly necessary, but the data it processes should be described in the privacy notice.

Block MTCaptcha until consentScan my site
Overview

What does MTCaptcha do?

What is MTCaptcha

MTCaptcha is a CAPTCHA service designed as a GDPR friendly alternative to Google reCAPTCHA. It displays image or noPuzzle challenges that confirm a real human is interacting with a form. MTCaptcha is operated by a Hong Kong company with EU infrastructure in Germany and an explicit EU only mode that keeps every request inside the EEA.

Data and cookies collected

MTCaptcha loads a small JavaScript widget that talks to service.mtcaptcha.com (or eu.mtcaptcha.com in EU only mode). It processes the visitor IP, the user agent, the timing of the challenge and a short lived nonce, but does not set advertising cookies and does not build a behavioural profile across websites. A first party verification token is stored in the form during the challenge to validate it server side.

GDPR and ePrivacy implications

Because MTCaptcha is only used to secure a service explicitly requested by the user (submitting a form, creating an account), the EDPB exemption for strictly necessary storage applies. Article 5(3) of the ePrivacy Directive does not require consent for that scope. The IP processing is covered by legitimate interest under article 6(1)(f) GDPR.

Consent and legal basis

No prior consent is required as long as MTCaptcha is used exclusively for anti spam and bot detection on the operator forms. The legal basis is article 6(1)(f) GDPR. If MTCaptcha is integrated together with marketing scoring or advertising attribution, the situation changes and consent must be collected.

Data transfers

The EU only mode pins MTCaptcha to eu.mtcaptcha.com, where data stays in Frankfurt. In the global mode, edge servers may be located outside the EEA. Pick the EU mode for Schrems II sensitive use cases and sign the MTCaptcha DPA to document the residency choice.

Practical compliance steps

Activate the EU only mode, sign the MTCaptcha DPA, list MTCaptcha as a security processor in the record of processing, mention it in the privacy notice with the legitimate interest basis and document the bot protection use case. No CMP category is needed for the default anti spam configuration.

Compliance

MTCaptcha and the GDPR

Legal basis
Article 6(1)(f) GDPR: legitimate interest in protecting the website from spam, bots and abuse. MTCaptcha is considered a security technology and qualifies for the strictly necessary exemption of article 5(3) ePrivacy Directive when used solely for that purpose.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive 2002/58/EC, German Federal Data Protection Act (BDSG)

Impact assessment (DPIA)

A DPIA is not required for MTCaptcha in normal anti spam configuration. It is recommended when the service is deployed in sensitive flows such as account creation in the health, public sector or financial industries, or combined with risk scoring.

Sample text for your banner

We use MTCaptcha to detect bots and protect our forms. MTCaptcha runs in our EU only configuration and uses strictly necessary technical storage to validate the challenge. No tracking cookie is involved.
Cookies and trackers

What MTCaptcha sets and contacts

Tracking method
JavaScript widget served from mtcaptcha.com that challenges human visitors with CAPTCHA puzzles; relies on first-party storage and HTTP requests, no behavioural advertising cookies
Server location
European Union (Germany) with optional global edge; EU only mode available
Cookieless mode available
Yes

Cookies set (1)

NameTypeDurationPurpose
mtcaptcha_verifiedtokenfirst-partysessionStrictly necessary token stored on the form during the challenge to validate the visitor anti spam check server side.

Third-party domains contacted (4)

  • mtcaptcha.com
  • service.mtcaptcha.com
  • eu.mtcaptcha.com
  • service2.mtcaptcha.com
Questions

Frequently asked questions about MTCaptcha

Can't find your question? Write to us, we answer fast.

Which cookies does MTCaptcha set?

MTCaptcha does not set advertising cookies. It uses a short lived verification token passed through the form and ephemeral storage to coordinate the challenge. Some technical localStorage entries can be created to remember the last challenge state but they do not identify the visitor across sites.

Is consent required to load MTCaptcha?

No, when MTCaptcha is used strictly for anti spam and bot detection on user submitted forms. The strictly necessary exemption of article 5(3) ePrivacy Directive applies and the legal basis is article 6(1)(f) GDPR (legitimate interest in protecting the service).

What is the legal basis for processing data through MTCaptcha?

Article 6(1)(f) GDPR, legitimate interest in protecting the operator forms and services from abuse and bots. The balancing test is in favour of the operator because MTCaptcha is privacy oriented, does not profile users and is limited to the security purpose.

Does MTCaptcha transfer data to the United States?

In the EU only configuration data stays on eu.mtcaptcha.com infrastructure in Germany. In the default global configuration edge servers may be located in the US or APAC; check the regional setting in the MTCaptcha dashboard and sign the appropriate Standard Contractual Clauses if a transfer is involved.

Do I need a DPIA before using MTCaptcha?

No, a DPIA is not required for a standard MTCaptcha integration. It becomes relevant when MTCaptcha is part of a sensitive flow (health, finance, public sector account creation) or coupled with risk scoring that could produce decisions with legal effects.

How do I implement MTCaptcha in a GDPR compliant way?

Enable EU only mode, sign the MTCaptcha DPA, list MTCaptcha as a security processor in the record of processing, mention it in the privacy notice with the legitimate interest basis and disable the captcha on pages where it is not strictly necessary to keep the data minimisation principle.

Are there alternatives to MTCaptcha?

Privacy oriented CAPTCHA alternatives include Cloudflare Turnstile, hCaptcha, Friendly Captcha (EU based) and Altcha (open source). Each offers different trade offs in terms of accessibility, accuracy and data residency; Friendly Captcha is fully EU hosted.

How should I update the cookie policy for MTCaptcha?

State that MTCaptcha is used as a strictly necessary anti spam mechanism, that no advertising cookies are set, that the legal basis is legitimate interest, that the EU only mode is enabled and link to the MTCaptcha privacy notice. No CMP toggle is required.

Same category

More services: Security

See the whole category

SiteGuard WP Plugin

SiteGuard WP Plugin is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. SiteGuard WP Plugin supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, SiteGuard WP Plugin remains a leading web development choice.

Essential

IPInfoDB

IPInfoDB is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. IPInfoDB supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, IPInfoDB ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

IBM DataPower

IBM DataPower is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. IBM DataPower integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, IBM DataPower helps organizations maintain robust websites that meet user expectations and technical requirements.

Security

Fortinet FortiGate

Fortinet FortiGate is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. Fortinet FortiGate offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, Fortinet FortiGate strengthens your overall security posture.

Essential

WWPass

WWPass is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. WWPass supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, WWPass enables informed decisions that improve experience and drive results.

Essential

RingCaptcha

RingCaptcha is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. RingCaptcha supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, RingCaptcha enables informed decisions that improve experience and drive results.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site