> Is Vaptcha GDPR compliant? The risks of using this Chinese CAPTCHA on EU websites, the data transfers to China and CAPTCHA alternatives to consider.
>
> Canonical: https://www.flowconsent.com/en/services/security/vaptcha

Security

# Vaptcha

Essential · [Official website](https://en.vaptcha.com)

Vaptcha is a Chinese CAPTCHA and bot-detection service that uses behavioral analysis and gesture verification to distinguish humans from bots. When embedded on EU websites, visitor behavioral data, IP addresses, and browser fingerprints are transmitted to Vaptcha servers in China. China has no EU adequacy decision, making this a high-risk international transfer. European data protection authorities strongly recommend replacing Vaptcha with EU-hosted CAPTCHA alternatives such as hCaptcha or Friendly Captcha.

[Block Vaptcha until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan)

At a glance

- Category

  [Security](https://www.flowconsent.com/en/services/security)

- Consent

  Essential

- Prior consent

  Required

- Documented cookies

  4

- Third-party domains

  4

- Servers

  China (Vaptcha is a Chinese CAPTCHA service)

Overview

## What does Vaptcha do?

## **What is Vaptcha?**

Vaptcha is a Chinese CAPTCHA service that uses gesture-based human verification and behavioral analysis. It is widely used in China and increasingly embedded in international websites. When loaded on EU websites, it transmits visitor behavioral data, IP addresses, and browser fingerprints to Vaptcha servers in China.

## **The China transfer problem**

China has no EU adequacy decision. The Chinese Cybersecurity Law, Data Security Law, and National Security Law require Chinese companies to provide data access to authorities upon request. SCCs with Chinese entities are theoretically possible but practically difficult to enforce. EU DPAs including the French CNIL and German DPAs have flagged transfers to China as problematic.

## **Recommended alternatives**

EU-hosted CAPTCHA alternatives: hCaptcha (privacy-focused, US but with EU data options), Friendly Captcha (German, EU-hosted, no personal data processing), Altcha (open-source, self-hostable), or CloudFlare Turnstile. All provide effective bot protection without China data transfers.

## **Practical compliance steps**

Immediately replace Vaptcha with a GDPR-compliant CAPTCHA alternative. If replacement is not immediately possible: conduct a DPIA, implement consent before loading Vaptcha, attempt SCCs with Vaptcha, and document the risk assessment. Replacement is strongly recommended.

Compliance

## Vaptcha and the GDPR

Vaptcha is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

- Legal basis

  Legitimate interest (Art. 6(1)(f)) for anti-bot protection purposes may apply for strictly necessary CAPTCHA functionality. However, the China transfer and Chinese surveillance law concerns significantly complicate this. Consent (Art. 6(1)(a)) is more defensible. European privacy advocates recommend replacing Vaptcha with EU-hosted alternatives.

- Risk level

  high

- Applicable regulations

  GDPR, ePrivacy, GDPR Chapter V (international transfers to China)

### Impact assessment (DPIA)

A DPIA is strongly recommended for Vaptcha given the China data transfer with no adequacy decision, potential exposure to Chinese intelligence law, and the processing of behavioral biometric data. Consider this a high-risk processing activity.

### Sample text for your banner

> This site uses Vaptcha for bot protection. Vaptcha processes behavioral interaction data on servers in China. Please accept to use this feature or contact us for an alternative.

Cookies and trackers

## What Vaptcha sets and contacts

- Tracking method

  JavaScript CAPTCHA widget, client-side behavioral analysis, server-side verification, IP and interaction data collection

- Server location

  China (Vaptcha is a Chinese CAPTCHA service)

- Data transferred outside the EU

  Vaptcha is a Chinese CAPTCHA and bot-detection service. When integrated on EU websites, visitor IP addresses, browser fingerprints, and behavioral interaction data are transmitted to Vaptcha servers in China. China has no EU adequacy decision. SCCs are required but may face compatibility challenges due to Chinese data access laws.

### Cookies set (4)

| Name                 | Type          | Duration | Purpose                                                                                                                 |
| -------------------- | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- |
| vaptcha\_token       | security      | Session  | Stores the CAPTCHA verification token after the user completes the challenge, used for server side validation.          |
| vaptcha\_vid         | security      | 24 hours | Assigns a visitor identifier for behavioral analysis to distinguish humans from bots.                                   |
| vaptcha\_risk\_score | security      | Session  | Stores the computed risk score from client side behavioral analysis including mouse movements and interaction patterns. |
| vaptcha\_lang        | functionality | 1 year   | Remembers the selected language preference for the CAPTCHA widget interface.                                            |

### Third-party domains contacted (4)

- `www.vaptcha.com`
- `api.vaptcha.com`
- `cdn.vaptcha.com`
- `v.vaptcha.com`

Questions

## Frequently asked questions about Vaptcha

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### What cookies does Vaptcha set?

Vaptcha is a human verification (captcha) service that sets cookies to distinguish legitimate users from bots. These include session tokens, risk assessment identifiers, and device fingerprint data. Vaptcha may store persistent cookies to remember verified users and reduce repeated challenges.

### Is consent required to use Vaptcha?

Vaptcha occupies a nuanced position under the ePrivacy Directive. If used solely for security purposes (bot protection on login or contact forms), it may qualify as strictly necessary and not require prior consent. However, if Vaptcha sets persistent tracking cookies beyond what is needed for verification, consent may be required.

### What is the legal basis for using Vaptcha?

The primary legal basis is legitimate interest under Article 6(1)(f) GDPR for protecting your website against automated abuse. For strictly necessary security cookies, Article 5(3) of the ePrivacy Directive provides an exemption. Document your legitimate interest assessment to justify why Vaptcha is needed.

### Does Vaptcha transfer data to third countries?

Vaptcha is developed by a Chinese technology company, and data may be processed on servers located in China. This constitutes a transfer to a third country without an EU adequacy decision. You must implement appropriate safeguards and clearly disclose this transfer in your privacy policy.

### Is a DPIA required for Vaptcha?

A DPIA is recommended for Vaptcha implementations because the service processes device fingerprints and behavioral data, involves data transfers to China (a country without an EU adequacy decision), and applies automated decision making to determine human versus bot status.

### How do I implement compliance with Vaptcha?

Disclose Vaptcha's use in your privacy policy, including data transfers to China. If consent is required, integrate Vaptcha loading with your consent management platform. Consider using Vaptcha only on forms where bot protection is genuinely necessary rather than site wide. Document your legitimate interest assessment.

### Are there privacy friendly alternatives to Vaptcha?

Consider EU based or privacy focused captcha solutions such as hCaptcha (with privacy options), Friendly Captcha (German company, GDPR focused), or mCaptcha (open source, self hosted). These alternatives process data within the EEA and minimize tracking, reducing compliance complexity.

### How do I update my cookie policy for Vaptcha?

Add Vaptcha to your cookie declaration listing all cookies it sets, including session tokens, verification identifiers, and any persistent cookies. Specify that data is processed by Vaptcha in China, state the purpose as security and bot prevention, and include cookie durations and types.

Same category

## More services: Security

[See the whole category](https://www.flowconsent.com/en/services/security)

### [SafeBase](https://www.flowconsent.com/en/services/security/safebase)

[SafeBase is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. SafeBase integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, SafeBase helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/safebase)

[Essential](https://www.flowconsent.com/en/services/security/safebase)

·

### [Alibaba Cloud Verification Code](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code)

[Alibaba Cloud Verification Code is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Alibaba Cloud Verification Code provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Alibaba Cloud Verification Code ensures optimal performance at scale.](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code)

[Essential](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code)

·

### [IPinfo](https://www.flowconsent.com/en/services/security/ipinfo)

[IPinfo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. IPinfo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, IPinfo helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/ipinfo)

[Essential](https://www.flowconsent.com/en/services/security/ipinfo)

·

### [Kerberos](https://www.flowconsent.com/en/services/security/kerberos)

[Kerberos is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Kerberos integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Kerberos helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/kerberos)

[Essential](https://www.flowconsent.com/en/services/security/kerberos)

·

### [OpenSSL](https://www.flowconsent.com/en/services/security/openssl)

[OpenSSL is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. OpenSSL integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, OpenSSL helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/openssl)

[Security](https://www.flowconsent.com/en/services/security/openssl)

·

### [VentryShield](https://www.flowconsent.com/en/services/security/ventryshield)

[VentryShield is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. VentryShield integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, VentryShield helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/ventryshield)

[Essential](https://www.flowconsent.com/en/services/security/ventryshield)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)