Yandex SmartCaptcha

SmartCaptcha collects the visitor IP address, User Agent, screen and timezone information, mouse and keyboard movement patterns, touch events, browser fingerprinting signals (canvas, WebGL, audio context, installed fonts) and the referring URL. It sets cookies and stores tokens on smartcaptcha.yandexcloud.net and captcha.yandex.ru to remember validated sessions. All signals are transmitted to Yandex servers in the Russian Federation for evaluation. The result is a confidence score and a binary verdict that the embedding site uses to allow or block the form submission.

Yes. Because SmartCaptcha stores tokens and cookies on the terminal and collects fingerprinting signals, it falls under Art. 5(3) ePrivacy and requires prior, freely given, specific and informed consent. The CNIL, the German DSK and the AEPD do not accept the strictly necessary exemption for a third country CAPTCHA that performs profiling. The challenge script must be blocked until the visitor accepts a security or anti bot consent category, and a fallback verification path must be offered to users who decline.

Consent under Art. 6(1)(a) GDPR combined with Art. 5(3) ePrivacy is the safest basis. Legitimate interest under Art. 6(1)(f) is contested because the necessity test cannot be satisfied when EU based alternatives (hCaptcha, Cloudflare Turnstile, Friendly Captcha) provide equivalent protection without third country transfer. If consent is collected, it must be granular, separated from other purposes, easily withdrawable, and recorded in the consent management platform with proof of acceptance.

Yes. SmartCaptcha processes data in Yandex Cloud data centres located in Moscow and Vladimir. Russia has no European Commission adequacy decision under Art. 45 GDPR, so transfers must rely on Standard Contractual Clauses (Art. 46) together with the supplementary measures recommended by the EDPB after Schrems II. A Transfer Impact Assessment must address Federal Law 374 FZ (Yarovaya Law), the SORM lawful interception regime and FSB access powers, and explain why technical or contractual safeguards mitigate the residual risk.

A Data Protection Impact Assessment under Art. 35 GDPR is strongly recommended. The processing meets several criteria from the EDPB list: systematic monitoring through behavioural signals, automated decisions that may block legitimate users, and transfers to a third country without adequacy. The DPIA should compare SmartCaptcha to EU alternatives, document the Transfer Impact Assessment, list the safeguards (SCC, encryption in transit, contractual restrictions on government requests) and quantify the residual risk for data subjects.

Block the SmartCaptcha script until the visitor consents through the cookie banner using a dedicated security category. Limit the challenge to high risk endpoints (login, registration, payment) instead of every page. Sign the Yandex Cloud Data Processing Agreement and the Standard Contractual Clauses addendum. Document the Transfer Impact Assessment and update the privacy notice, the record of processing activities and the cookie register. Provide an accessible fallback verification path so refusing consent does not lock users out.

EU friendly alternatives include hCaptcha (Intuition Machines, EU servers and SCCs), Cloudflare Turnstile (US under EU US Data Privacy Framework and SCCs), Friendly Captcha (Germany, privacy by design, no fingerprinting), Altcha (open source, self hostable) and Anubis or simple proof of work challenges. For low risk forms, server side measures such as honeypot fields, rate limiting and time on form checks can replace a third party captcha entirely.

List Yandex SmartCaptcha by name in the cookie register under the security or bot protection category. Disclose the controller (Yandex LLC), the data categories (IP, fingerprinting signals, behavioural data), the cookies and tokens set, the retention period, the legal basis (consent), the transfer destination (Russia) and the safeguards (SCC plus Transfer Impact Assessment). Provide a link to Yandex Cloud privacy documentation. Update the policy when you change provider or when the EDPB or your national DPA issues new guidance on Russian processors.