Is your captcha GDPR compliant? Six options checked
For a small business site with a contact or sign-up form, EU visitors and no privacy staff. Google reCAPTCHA against 5 captchas sold as the privacy-friendly choice, measured on what decides whether a captcha fits the GDPR: what it reads from the device, what it does with the data, who holds it and where. Every cell comes from each vendor’s own pages. read 2026-10-24
Best for keeping every visitor’s data on your own server
ALTCHA
Its own pages meet 7 of the 7 rows: no cookies, an MIT-licensed widget you run yourself, and an EU cloud if you would rather not.
Best for a hosted captcha that stays in the EU
Friendly Captcha
A German processor with an Art. 28 agreement, no cookies or browser storage, and a dedicated EU endpoint. Ask for the DPA text first.
Best free hosted widget with no cookies
Prosopo Procaptcha
Cookieless by default with a DPA on every plan, the free one included; EU-only processing waits for its Enterprise plan.
The GDPR checks, captcha by captcha
Each row is something the EU device rule or the GDPR asks of a captcha, with the article it comes from. reCAPTCHA sits in the first column as the baseline most forms already run. Read across for one rule; read down for one captcha. If the captcha is the last script that needs consent on your site, the Google Analytics alternatives page covers the usual other one.
| Requirement | Google reCAPTCHA | hCaptcha | Cloudflare Turnstile | Friendly Captcha | Prosopo Procaptcha | ALTCHA |
|---|---|---|---|---|---|---|
| Stores nothing on the visitor’s deviceePrivacy Art. 5(3) | no_GRECAPTCHA cookie | nocookies it calls consent-exempt | not statedpre-clearance sets a cookie | yesno cookies or storage | yescookieless by default | yesno cookies |
| Acts as your processor under a DPAGDPR Art. 28(3) | yessince 2 April 2026 | yesin its terms, every plan | yesfor site protection | yesArt. 28 agreement | yesevery plan | yesCloud; self-hosted needs none |
| Uses the data only to protect your siteGDPR Art. 5(1)(b); Art. 28(10) | yesservice and its security | partialanswers become labeled data | partialalso improves Turnstile | yesbots vs humans only | yesno cross-site profiling | yesno third-party sharing |
| Says which visitor data it collectsGDPR Art. 13(1); Art. 28(3) | not statedpoints to its terms | partialIP in sampled logs | yesIP, TLS fingerprint, user agent | yesIP, hashed one way | yesIP and a session ID | yesno personal data |
| Keeps the processing in the EUGDPR Art. 44 | not stated | paid planEU-only on Enterprise | not stated | yesEU endpoint | paid planEU-only on Enterprise | yesEU cloud or your server |
| Names its basis for transfers out of the EUGDPR Art. 45(1); Art. 46(2)(c) | yesSCCs in the Cloud DPA | yesSCCs and the DPF | yesSCCs and the DPF | yesnone made, EU only | not statedUK company | yesnone made, EU or yours |
| Can run on your own serverno outside processor (Art. 28) | not stated | paid planEnterprise first-party hosting | not stated | not stated | yesself-hosting offered | yesopen source, MIT |
Source: vendor pages, terms and docs, read 2026-10-24. “not stated” means the vendor’s own documentation does not say. | ||||||
Does a captcha need consent under GDPR?
Most vendors here call their captcha GDPR compliant, but a tool cannot be compliant on its own: compliance belongs to the site that embeds it and to how it is set up. The question a regulator would ask comes in three layers, and a captcha can clear one and fail the next. Our cookie banner checklist covers the first layer for every other script on the page.
- 01
The device: does it read or store anything?
Storing or reading anything on the visitor’s device needs consent, unless it is strictly necessary for a service the visitor explicitly asked for. A captcha on a form the visitor chose to send is the strongest case for that exemption. One whose data also serves the vendor’s own ends is a weaker one.
ePrivacy Art. 5(3)3 of 6 meet the row on their own pages
Stores nothing on the visitor’s device
- 02
The reason: is security enough without consent?
Yes, within limits. Recital 49 names network and information security as a legitimate interest, to the extent the processing is strictly necessary and proportionate. That holds only while the captcha’s data serves the security purpose and nothing else.
GDPR Art. 6(1)(f), Recital 494 of 6 meet the row on their own pages
Uses the data only to protect your site
- 03
The contract: who holds the data, and where?
A hosted captcha processes visitor data for you, so it needs a processor contract with the Art. 28(3) terms. If that data leaves the EU, the transfer needs an adequacy decision or safeguards such as the standard contractual clauses.
GDPR Art. 28(3), Art. 445 of 6 meet both rows on their own pages
Acts as your processor under a DPA; Names its basis for transfers out of the EU
The device rule is about reading the device, not about cookies. The European Data Protection Board’s guidelines on the reach of Art. 5(3), adopted on 7 October 2024, put script-driven reads inside it:
“Additional examples would include JavaScript code, where the accessing entity instructs the browser of the user to send asynchronous requests with the targeted information. Such access clearly falls within the scope of Article 5(3) ePD”
A captcha that reads browser signals is that kind of script, cookie or no cookie. The same guidelines add that falling under the rule does not always mean consent is needed, since an exemption may apply (¶ 56). Neither the guidelines nor any regulator text we read names captchas, so whether yours is “strictly necessary” is a judgment you document: which form it guards, what it reads, and that the vendor uses the data for nothing else. Information, not legal advice.
The CCPA has no consent step for a captcha. “Helping to ensure security and integrity” is a listed business purpose, to the extent the use of personal information is reasonably necessary and proportionate (§ 1798.140(e)(2)). What matters is the contract: a vendor held to service-provider terms is not a third party you sell to or share with (§ 1798.140(ag)(1), (ai)(2)). Our GDPR vs CCPA guide sets the two approaches side by side.
reCAPTCHA after 2 April 2026, and your privacy notice
Until April 2026 Google treated itself as an independent controller of reCAPTCHA data, which is why sites were told to show Google’s privacy policy and terms beside the badge. From 2 April 2026 Google acts as a processor under its Cloud Data Processing Addendum, and its reCAPTCHA FAQ recommends removing those references from your own site. The _GRECAPTCHA cookie stays exactly as it was.
So the job moves to your notice. Google’s FAQ asks customers to check that their own privacy disclosures cover the purpose of the processing: security, fraud and abuse prevention. The same is true whichever captcha you pick. If you are writing the notice from scratch, the privacy policy checklist walks the full Art. 13 list.
The six lines a captcha adds
- 01
Purpose
Art. 13(1)(c)Protecting the form from spam and automated abuse, and nothing else.
- 02
Legal basis
Art. 13(1)(c), (d)Legitimate interests, Art. 6(1)(f), and the interest itself: keeping the form and the site secure.
- 03
Recipient
Art. 13(1)(e)The captcha vendor, named, as your processor.
- 04
Transfer
Art. 13(1)(f)The country the vendor processes in, if outside the EU, and the safeguard it relies on (an adequacy decision or the standard contractual clauses).
- 05
Retention
Art. 13(2)(a)How long the vendor keeps the data, or the criteria for it, from its DPA.
- 06
Device access
ePrivacy Art. 5(3)Any cookie or stored item the captcha sets, in your cookie list, with why it is strictly necessary.
Then sign or accept the vendor’s DPA before the captcha goes live, and file it with your other processor contracts. Our data processing agreement template lists the clauses Art. 28(3) requires, so you can check the vendor’s against it.
Each captcha in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor before you swap it in. If the captcha will sit on a form that collects more than an email address, the GDPR checklist covers the rest of what that form starts.
Google reCAPTCHA
What it is
The captcha most contact forms and form plugins already ship with, now sold as part of Google Cloud’s Fraud Defense. It checks whether a form submission comes from a person or a bot and hands the result to your server.
Who it fits
A site that already runs it and wants to know what the April 2026 change means for its notice and its contract, before deciding whether to move.
What the rule requires and whether it meets it
From 2 April 2026 Google acts as your processor under its Cloud Data Processing Addendum, uses the data only to run and secure the service, and asks you to remove references to Google’s own privacy policy from your site. It still sets its _GRECAPTCHA cookie, which Google calls necessary.
Check with the vendor
The FAQ does not say where the data is processed or list what is collected; it points to the addendum and the service terms. Read both before you update your privacy notice.
hCaptcha
What it is
A drop-in reCAPTCHA replacement from Intuition Machines, a US company. It has a free Basic plan and paid Pro and Enterprise tiers.
Who it fits
A site that wants to swap reCAPTCHA with the least code change and is content with a US vendor that relies on standard contractual clauses and the Data Privacy Framework.
What the rule requires and whether it meets it
Its master terms build in its DPA and the EU and UK clauses on every plan, so there is nothing extra to sign. It stores analytics data in the EU by default, and keeps EU-only processing and its “Zero PII” and first-party hosting options for Enterprise.
Check with the vendor
Its privacy policy describes answers to its image prompts as labeled data for machine learning, and its widget sets cookies it considers consent-exempt. Ask how the labeling use fits the purpose in your notice.
Cloudflare Turnstile
What it is
Cloudflare’s captcha replacement. Cloudflare says it can be embedded in any website without sending traffic through Cloudflare, and works without showing visitors a captcha. The free plan allows up to 20 widgets per account.
Who it fits
A site that wants a free, low-friction check and is comfortable with a split role: processor for your site, controller for its own improvement work.
What the rule requires and whether it meets it
Its privacy addendum lists the signals it reads (IP address, TLS fingerprint, user agent, site key and origin) and calls Cloudflare your processor when it protects your site. Cloudflare’s customer DPA brings in the EU clauses and names the Data Privacy Framework.
Check with the vendor
The same addendum makes Cloudflare a controller, on its own legitimate interest, when it uses those signals to improve Turnstile. Its widget pages do not say whether the standard widget stores anything on the device; pre-clearance mode sets a cookie.
Friendly Captcha
What it is
A German proof-of-work captcha: the visitor’s browser solves a small crypto puzzle in the background, so there are no images to click. It offers a free plan for non-commercial sites with low traffic.
Who it fits
A firm with EU visitors that wants the processing kept in the EU by a company established there, with a contract built for it.
What the rule requires and whether it meets it
Its terms call it your processor and set out an Art. 28 agreement. It uses no HTTP cookies and no persistent browser storage, hashes the IP address one way before storing it, and processes requests in the EU through a dedicated endpoint.
Check with the vendor
The DPA page itself is password-protected, so we could not read its clauses. Ask for a copy before you sign up, and confirm that your plan uses the EU endpoint.
Prosopo Procaptcha
What it is
A UK-built widget for forms, cookieless by default, with a free plan for one site at low volume and a paid Professional plan. Its Enterprise product, Prosopo Protect, covers whole sites and APIs.
Who it fits
A small site that wants a free hosted widget with no cookies and a DPA from the first plan.
What the rule requires and whether it meets it
It says it processes an IP address and a short-lived session identifier, under legitimate interest, with no cross-site profiling. Its plan table lists a data processing agreement on every plan, and it offers self-hosting.
Check with the vendor
EU-only processing starts at Enterprise, and the pages we read do not name a transfer basis. The UK holds an EU adequacy decision; ask Prosopo where your requests are processed on the free and Professional plans.
ALTCHA
What it is
An open-source proof-of-work widget under the MIT licence, from a Czech company. You can run the free widget yourself, or use its paid Cloud or self-hosted Sentinel plans for adaptive bot checks.
Who it fits
A firm that can add a server-side check to its form and wants no outside processor in the path at all.
What the rule requires and whether it meets it
It says it sets no cookies, does no fingerprinting and shares no data with third parties. Self-hosted, nothing reaches a vendor; ALTCHA Cloud runs inside the EU, and its legal page carries DPA documentation for Cloud and Sentinel.
Check with the vendor
Self-hosting makes you the operator: keeping the widget updated and tuning it against spam are your jobs. The adaptive checks need a paid plan.
How we compared them
We started from reCAPTCHA, the captcha most form plugins ship with, and five alternatives that sell themselves on privacy, the ones a small site meets when an EU visitor or a data protection question makes it look again: two hosted widgets from US firms, two from European firms, and one open-source widget you can run yourself. Bot-management suites priced for large sites are left out. Our GDPR compliance software page covers the tools that run the rest of the program.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-24; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Is Google reCAPTCHA GDPR compliant?
No tool is compliant on its own; your use of it is. Since 2 April 2026 Google acts as your processor for reCAPTCHA under its Cloud Data Processing Addendum, which settles the contract question. Two questions stay with you: the _GRECAPTCHA cookie it sets falls under the EU device rule, so you must be able to show it is strictly necessary for the form, and your privacy notice must cover the processing.
Do I need a cookie banner for a captcha?
Not if the captcha’s access to the device is strictly necessary for the form the visitor chose to send, because Art. 5(3) exempts that. Regulators have not ruled on captchas by name, so keep a note of why yours is necessary and list any cookie it sets in your cookie policy. A captcha that uses the data for other purposes is harder to defend as strictly necessary.
Is a cookieless captcha automatically outside the cookie rule?
No. The EDPB’s guidelines on Art. 5(3) say that JavaScript instructing the browser to send information back falls within the rule, with or without a cookie (¶ 33). Falling within it does not always mean consent is needed, because an exemption may apply (¶ 56). A cookieless design makes the strictly necessary case easier to argue; it does not remove the question.
Can I use legitimate interest as the legal basis for a captcha?
For the data processing, usually yes: Recital 49 of the GDPR names network and information security as a legitimate interest, to the extent the processing is strictly necessary and proportionate, and Art. 6(1)(f) is the basis to cite. Two limits: legitimate interest does not cover the device access itself, which runs on the ePrivacy rule, and it covers only the security purpose, not a vendor’s other uses.
Does a US captcha vendor make my EU data transfer unlawful?
Not if the transfer has a basis. The EU-US Data Privacy Framework is an adequacy decision for US organisations on the Framework List, and the Commission’s standard contractual clauses are an appropriate safeguard. hCaptcha and Cloudflare name both in their own pages; Google’s Cloud addendum uses the clauses. Our Google Analytics and GDPR guide covers what the Framework means for a US tool, and how to check the List.
Which captcha needs the least paperwork?
A self-hosted one, because no outside processor sees the data: there is no DPA to sign and no transfer to explain. ALTCHA’s open-source widget and Procaptcha’s self-hosting option work that way. Among hosted ones, the table shows which keep the processing in the EU and set nothing on the device.