Google reCAPTCHA
Google reCAPTCHA is a free bot and spam protection service from Google that verifies users are human through challenge tests (v2) or invisible behavioural analysis (v3). It sets Google cookies and sends browser fingerprinting data to Google's US servers. European DPAs and courts have questioned reCAPTCHA's GDPR compliance due to its persistent Google cookies and opaque data processing. hCaptcha and Cloudflare Turnstile are privacy-focused alternatives.
What does Google reCAPTCHA do?
What is Google reCAPTCHA?
Google reCAPTCHA is a free CAPTCHA service from Google that protects websites from bots and spam. reCAPTCHA v2 presents visible challenges ('I am not a robot' checkbox, image selection). reCAPTCHA v3 operates invisibly in the background, assigning a risk score to every user session without visible interaction. reCAPTCHA Enterprise offers enhanced privacy controls for larger deployments.
GDPR concerns: cookies and data processing
reCAPTCHA sets several Google cookies (NID, _GRECAPTCHA) and sends browser fingerprinting data to Google. Under the ePrivacy Directive, setting non-essential cookies on user devices requires consent. The German Landesdatenschutzbeauftragte Baden-Württemberg has specifically raised concerns about reCAPTCHA's GDPR compliance. The key tension: reCAPTCHA is a security measure (legitimate interest) but sets cookies that may be used for Google advertising purposes (requiring consent).
reCAPTCHA v3 and transparency
reCAPTCHA v3 presents particular GDPR challenges: it runs invisibly on every page without user interaction, users cannot opt out or complete an alternative challenge, and the data it sends to Google for scoring is not fully disclosed. The GDPR transparency principle requires clear disclosure of all data processing. If reCAPTCHA v3 is deployed site-wide, users must be informed in the privacy policy.
GDPR-compliant alternatives
hCaptcha is a privacy-focused CAPTCHA alternative that does not use Google's infrastructure and provides clearer GDPR terms. Cloudflare Turnstile is a CAPTCHA-free challenge that minimises data collection. Both provide bot protection without the Google data-sharing concerns. For non-public forms, honeypot techniques provide bot protection with zero data collection.
Practical compliance steps
Disclose reCAPTCHA in your privacy policy including Google's data processing and US transfer. Sign Google's data processing agreement. Consider whether legitimate interest covers the security use case or whether consent is needed. For v3, ensure site-wide disclosure. Consider switching to hCaptcha or Cloudflare Turnstile for simpler GDPR compliance.
Google reCAPTCHA and the GDPR
Google reCAPTCHA is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- The legal basis for reCAPTCHA is contested in Europe. Legitimate interest (Art. 6(1)(f)) may support bot prevention as a security measure, but reCAPTCHA also sets persistent Google cookies (NID, _GRECAPTCHA) on user devices. Under the ePrivacy Directive, setting non-essential cookies requires consent. The German DPA and others have questioned reCAPTCHA's GDPR compliance. hCaptcha is a privacy-focused alternative.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, SCCs for US transfers. reCAPTCHA v3 runs invisibly and raises particular transparency concerns.
Impact assessment (DPIA)
A DPIA is generally not required for standard reCAPTCHA security implementations. However, reCAPTCHA v3 runs on all pages invisibly, constituting broader monitoring that may warrant a risk assessment, particularly if Google uses the data for advertising purposes beyond bot detection.
Sample text for your banner
This website uses Google reCAPTCHA to protect forms from spam and abuse. reCAPTCHA uses cookies and sends data to Google in the US for security analysis. By using forms on this website you accept Google reCAPTCHA data processing.
What Google reCAPTCHA sets and contacts
- Tracking method
- JavaScript widget, browser fingerprinting, behavioural analysis, risk scoring, Google account signals, persistent cookies
- Server location
- United States (Google infrastructure)
- Data transferred outside the EU
- Google reCAPTCHA (v2 and v3) processes visitor browser data, IP addresses, cookies, and behavioural signals on Google's US infrastructure for fraud and bot detection purposes. EU personal data transfers require Standard Contractual Clauses. Google reCAPTCHA Enterprise has enhanced privacy controls.
Cookies set (1)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _GRECAPTCHA | persistent | 6 months | Google reCAPTCHA security token used for bot risk scoring and challenge verification |
Third-party domains contacted (3)
www.google.comwww.gstatic.comrecaptcha.net
Frequently asked questions about Google reCAPTCHA
Can't find your question? Write to us, we answer fast.
Does Google reCAPTCHA require GDPR consent?
The legal basis is contested. reCAPTCHA sets Google cookies (NID, _GRECAPTCHA) on user devices. Under ePrivacy, setting cookies requires consent. However, legitimate interest may support the security use case. German DPAs have raised concerns. The safest approach: use reCAPTCHA only on form pages (not site-wide), disclose in privacy policy, and consider whether consent or legitimate interest is documented.
What cookies does Google reCAPTCHA set?
reCAPTCHA sets _GRECAPTCHA (security token, 6 months) and may read the NID cookie (Google identifier, 6 months) if already present. These are Google cookies stored on the user's device, requiring an ePrivacy legal basis.
What is the difference between reCAPTCHA v2 and v3 for GDPR?
reCAPTCHA v2: visible challenge on specific pages (checkbox or image), only fires when user interacts with the form. reCAPTCHA v3: runs invisibly on every page visit without user interaction. v3 raises stronger GDPR concerns due to site-wide monitoring without user awareness.
Does reCAPTCHA transfer data to the US?
Yes. All reCAPTCHA processing occurs on Google's US infrastructure. SCCs are required. Accept Google's reCAPTCHA terms which include data processing terms. Disclose the US transfer in your privacy policy.
What are GDPR-compliant alternatives to Google reCAPTCHA?
hCaptcha: privacy-focused CAPTCHA with clearer GDPR terms, no Google data sharing. Cloudflare Turnstile: CAPTCHA-free challenge with minimal data collection, EU option available. Honeypot technique: invisible hidden form field that only bots fill, with zero data collection. All three provide bot protection without Google's data sharing concerns.
Is reCAPTCHA v3 a problem for transparency under GDPR?
Yes. reCAPTCHA v3 runs invisibly on every page without user awareness. GDPR's transparency principle requires clear disclosure of all data processing. If deployed site-wide, visitors must be clearly informed in the privacy policy that their browsing behaviour is analysed by Google for security purposes.
Does reCAPTCHA Enterprise resolve GDPR issues?
reCAPTCHA Enterprise offers enhanced privacy controls including the ability to not send data to Google for advertising purposes and clearer contractual terms. It is more GDPR-compliant than standard reCAPTCHA but still involves US data transfer and Google processing. Consult your DPO.
How do I disclose reCAPTCHA in my privacy policy?
State: that forms on the website are protected by Google reCAPTCHA, that reCAPTCHA collects hardware and software information and behavioural data and sends it to Google for analysis, that this data is processed in the US under SCCs, and link to Google's Privacy Policy and Terms of Service.
DDoS-Guard
DDoS-Guard is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. DDoS-Guard offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, DDoS-Guard strengthens your overall security posture.
CLEAR
Clear is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Clear integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Clear helps organizations maintain robust websites that meet user expectations and technical requirements.
HTTP Basic Authentication
Basic is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Basic integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Basic helps organizations maintain robust websites that meet user expectations and technical requirements.
Feroot
Feroot is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Feroot integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Feroot helps organizations maintain robust websites that meet user expectations and technical requirements.
IBM DataPower
IBM DataPower is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. IBM DataPower integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, IBM DataPower helps organizations maintain robust websites that meet user expectations and technical requirements.
SheerID
SheerID is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. SheerID is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, SheerID offers reliable solutions that scale with organizational needs and evolving web standards.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.