reCAPTCHA Changes 2026: The April Processing Update

What changed in reCAPTCHA in 2026?

Since April 2, 2026, Google processes reCAPTCHA data as a processor under its Google Cloud Data Processing Addendum, and you, the website operator, are the sole controller of that data. The reCAPTCHA badge no longer refers to Google’s Privacy Policy and Terms. The technology did not change: same script, same site keys, same cookie.

Google’s own wording is worth reading closely. Customers “have always been data controllers”, the FAQ says, and from April 2 they are the sole controller. So nothing new landed on your desk. What changed is that Google stopped acting as a controller of the same data next to you and now works on your instructions, under its cloud contract.

Two other reCAPTCHA changes came around the same time. Classic reCAPTCHA keys were moved into Google Cloud projects between late 2025 and early 2026, and on April 22, 2026 Google made reCAPTCHA part of a product suite called Google Cloud Fraud Defense.

What stayed the same

For your visitors and your developers, nothing. Google says the functionality and the site keys are unchanged. The v2 checkbox still shows image challenges when it is unsure, v3 still returns a score, and the _GRECAPTCHA cookie is still set. Google calls it a necessary cookie.

What also stayed the same is how little Google tells you. It does not publish the list of signals reCAPTCHA collects. That is the awkward part of the new model: as sole controller you have to describe a processing in your privacy policy that you cannot fully see.

reCAPTCHA Google Cloud migration

The processor change came at the end of a longer move into Google Cloud. It ran in these steps:

1. Q3 2024. Google stops issuing new classic keys.
2. Q4 2025. Google starts migrating classic keys into Google Cloud projects automatically.
3. Q1 2026. The automated migration is complete. API access is locked for keys without a Google Cloud project.

Your existing v2 and v3 site keys keep working after the migration. What changes is where you manage them: usage, billing and settings now sit in a Google Cloud project, and the old v2 and v3 developer pages are marked as deprecated in favor of the Cloud documentation.

reCAPTCHA is now part of Google Cloud Fraud Defense

On April 22, 2026 Google’s release notes announced that “reCAPTCHA is part of Google Cloud Fraud Defense”, a suite of security products. Google’s service terms now list the product as “Google Cloud Fraud Defense (formerly reCAPTCHA Enterprise)”.

The bot protection on your forms is still called reCAPTCHA. The tiers are now named Essentials, Premium and Enterprise. If you search Google’s documentation, look for Fraud Defense as well as reCAPTCHA.

reCAPTCHA free tier and limits

reCAPTCHA Essentials is free up to 10,000 assessments a month. Google counts that limit per organization, across all accounts and all sites, so three small sites on one Google Cloud organization share the same 10,000. The free tier also returns only four score levels (0.1, 0.3, 0.7 and 0.9) instead of eleven.

Above 10,000 you need a billing account. Premium costs an $8.00 flat fee for 10,001 to 100,000 assessments and $1.00 per 1,000 assessments beyond that. Enterprise is a fixed monthly volume at $1 per 1,000 assessments with a commitment of at least twelve months. The full breakdown, with sample bills, is on our reCAPTCHA pricing page.

One detail deserves a test in your own setup. If you go over the free limit without billing, Google says the classic siteverify endpoint “will return success:true with a score of 0.9” together with an error message, while the newer CreateAssessment API returns HTTP 429. A backend that only reads success and score lets every request through once the limit is reached, bots included.

What the change means for GDPR

Google answers the question in its FAQ with a plain “Yes” and points to its commitments in the Cloud Data Processing Addendum. That covers Google’s side. As sole controller, you still have to meet the GDPR obligations for your own site, and that includes naming reCAPTCHA in your privacy policy. Under Art. 13 GDPR the privacy policy has to say who processes the data, for what purpose, on which legal basis, whether data goes to countries outside the EU and how long it is stored.

Two questions stay open for many sites. One is data transfers, because the data goes to Google and transfers need a legal review. The other is the _GRECAPTCHA cookie: Google calls it necessary, but a vendor’s label does not settle whether storing it needs consent. This section is not legal advice; clear these points with your data protection officer.

The processor model is an improvement: Google can no longer use the data for its own purposes, such as personalized advertising. It does not answer the consent and transfer questions for you. Our article Is reCAPTCHA GDPR compliant? goes through them in detail.

What to do now if you use reCAPTCHA

1. Remove Google’s policy links. If you added links to Google’s Privacy Policy and Terms for the badge, Google asks you to remove them.
2. Review your privacy policy. If it still describes Google as a controller for reCAPTCHA, it no longer matches. We deliberately give no template, because the wording depends on how you use reCAPTCHA. Clear it with your data protection officer, together with the consent question.
3. Check billing and error handling. Make sure the 10,000-assessment limit cannot quietly let bots through.

With TrustCaptcha there are no cookies and no transfer to the US. What belongs in your privacy policy for it is in our TrustCaptcha GDPR guide.

Why CAPTCHA is still worth having

None of this makes CAPTCHA protection less necessary. Bots still target the cheap, exposed parts of a website: login pages, signup forms, free trials, password resets, contact forms and checkout. Without a check at those points, they test stolen passwords, fill forms with spam, scrape prices and skew your analytics.

The question is which CAPTCHA you want to be the controller for. Some ask you to describe a processing you cannot see. Others process less data and keep it in the EU.

Proof-of-work alone is not enough

Bots have become cheap to build. With language models and ready-made automation frameworks, attackers produce more convincing spam and signups at lower cost.

A proof-of-work CAPTCHA still helps here. It puts a computing cost on every request, which hurts large, low-effort attacks. But proof-of-work on its own only changes the economics. It does not tell you which traffic is suspicious, how risky a request is or what you should do about it.

That needs a detection layer on top: a risk score for each request and rules you control. Then you can let regular visitors through without friction, make suspicious traffic pay more and block what is clearly abuse.

TrustCaptcha: proof-of-work, bot score, honeypot and security rules

TrustCaptcha combines four layers in one CAPTCHA:

• Proof-of-work. The browser solves a small computation in the background. For a visitor it takes a moment; for a bot farm sending thousands of requests it becomes expensive. The difficulty rises with the risk of the request.
• Bot score. From the Solo plan, every verification gets a score, so your server can tell low-risk from high-risk requests and respond differently.
• Honeypot. Invisible honeypot fields are built in and catch simple form-spam bots without any setup.
• Security rules. IP allow and block lists from the Solo plan, and custom access rules, geoblocking and bypass keys from the Team plan, let you decide how strict the CAPTCHA is for whom.

TrustCaptcha sets no cookies, processes data in EU data centers and includes a Data Processing Agreement for every customer. If you are reviewing reCAPTCHA alternatives after the April change, this is what it was built for: a GDPR-compliant CAPTCHA whose processing you can describe in your privacy policy without guesswork.

Try TrustCaptcha

Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free. Start your free trial and see how proof-of-work and bot scoring hold up against your own traffic.