Is hCaptcha GDPR Compliant? Data, Transfers, Consent

Is hCaptcha GDPR compliant?

hCaptcha says it is: every plan carries the line “Complies with GDPR, CCPA, LGPD, PIPL, and more”, and its terms include a data processing agreement. That covers hCaptcha’s side of the contract. Whether your use of hCaptcha is compliant depends on three points the vendor leaves with you: the transfer of data to the USA, the cookies it sets and how your privacy policy describes it.

So hCaptcha’s “yes” covers its own side, not your whole assessment. The transfer, the cookies and the privacy policy entry stay on your desk.

Who is behind hCaptcha

hCaptcha is run by Intuition Machines, Inc., a Delaware corporation based in Miami, Florida. It is a CAPTCHA service for login forms, signups and checkouts, and it comes in three plans:

• Basic is free and runs in “Always Challenge” mode, so visitors solve image challenges.
• Pro costs $139 a month, or $99 a month billed yearly, and adds what hCaptcha calls its “99.9% Passive” mode, which shows far fewer challenges.
• Enterprise is priced on request and adds a passive (no-CAPTCHA) mode and risk scores.

The plan matters for more than price. On the free plan every visitor sees an image puzzle, which affects accessibility as much as privacy. hCaptcha offers email verification and text-based challenges in over 100 languages as accessibility options. For a side-by-side with other providers, see our hCaptcha alternatives.

What data hCaptcha processes

Every CAPTCHA processes technical data from the visitor’s browser to tell people from bots, at least the IP address and information about the browser and the request. Under GDPR, an IP address usually counts as personal data, so the processing needs a legal basis and a description in your privacy policy, whichever CAPTCHA you use.

hCaptcha acts as your processor for the end-user data it handles on your behalf. Its privacy policy lists the processing purposes and data categories in full.

Where hCaptcha data can go

hCaptcha’s privacy policy says data “may be stored and processed in any country where we have facilities or in which we engage service providers”, the USA included. Transfers out of the EU rely on the EU-U.S. Data Privacy Framework and standard contractual clauses. Its GDPR page adds that hCaptcha “processes the vast majority of data within one of our many regional servers around the world” and that analytics data is already stored in the EU.

For a website in the EU that leaves one question: is a transfer to a US company under the Data Privacy Framework acceptable for your organization? The framework has applied since July 2023. Its predecessor, the Privacy Shield, was struck down by the EU Court of Justice in 2020 in the Schrems II ruling, and that history is why many data protection officers look closely at US transfers. How your organization answers it is a decision for your data protection officer.

hCaptcha cookies and consent

hCaptcha’s privacy policy lists the cookies it uses, among them hmt_id, hc_accessibility, __cf_bm and Cloudflare load-balancing cookies. hCaptcha labels all of them strictly necessary.

That label is hCaptcha’s view. Whether storing these cookies on a visitor’s device needs consent under the ePrivacy rules is a legal assessment of your site, and a vendor’s label does not settle it. If the answer is yes, the CAPTCHA has to wait for consent, and a login or contact form behind it may not work for visitors who decline. Clear this point with your data protection officer before you rely on hCaptcha without a consent banner.

hCaptcha in your privacy policy

If you use hCaptcha, your privacy policy has to name it. Under Art. 13 GDPR that includes who processes the data, for what purpose, on which legal basis, whether data goes to countries outside the EU and how long it is stored. We deliberately give no template, because the wording depends on how you use hCaptcha. This section is not legal advice; clear the wording with your data protection officer.

With TrustCaptcha there are no cookies and no transfer to the US. What belongs in your privacy policy for it is in our TrustCaptcha GDPR guide.

Is there a GDPR-compliant alternative to hCaptcha?

The transfer and cookie questions disappear when the CAPTCHA comes from an EU company, processes data in the EU and sets no cookies. That is the profile of a GDPR-compliant CAPTCHA, and our overview of EU CAPTCHA providers lists the European options.

Google’s reCAPTCHA raises the same questions under a different contract model: since April 2026 Google acts as a processor, and transfers of reCAPTCHA data to Google still need a legal review. In recent years regulators and privacy advocates have looked closely at how services like reCAPTCHA process data, especially tracking and international transfers. In Austria the Federal Administrative Court (BVwG), and in France the data protection authority CNIL, found that reCAPTCHA, as it was used before April 2026, needed consent. That scrutiny has led many organizations to rethink their bot protection and look at options built on privacy by design. The details are in Is reCAPTCHA GDPR compliant?, and the two US services are compared directly in hCaptcha vs reCAPTCHA.

TrustCaptcha: no cookies, EU data centers

TrustCaptcha checks visitors in the background with proof-of-work, which gets harder as the risk of a request rises, and with bot scoring from the Solo plan up. Visitors have nothing to solve. TrustCaptcha sets no cookies, processes data in EU data centers and includes a Data Processing Agreement for every customer, so the transfer and cookie questions above do not come up.

Try TrustCaptcha

Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free with 500 verifications a month. Start your free trial and replace hCaptcha without adding a cookie to your site.