Is reCAPTCHA GDPR Compliant? Consent, Cookies, Transfers

Is reCAPTCHA GDPR compliant?

Google says yes. Since 2 April 2026 Google processes reCAPTCHA data as a processor under its Google Cloud Data Processing Addendum, you as the website operator are the sole controller, and Google’s FAQ answers “Is Fraud Defense GDPR compliant?” with a plain “Yes”. That settles Google’s side of the contract. It does not settle yours: the _GRECAPTCHA cookie raises a consent question, and transfers of the data to Google need a legal review.

The processor role came with a larger move. Classic keys were migrated into Google Cloud projects, billing now runs through Google Cloud, and in April 2026 reCAPTCHA became part of Google Cloud Fraud Defense. The timeline is in our overview of reCAPTCHA changes, the costs in reCAPTCHA pricing.

So the answer to “is reCAPTCHA GDPR compliant?” has two halves. Google’s part now has a contract behind it. Your part is the same work as for any other third-party script, plus two questions Google leaves open.

What data does reCAPTCHA send to Google?

Google does not publish a full list of the signals reCAPTCHA collects. A few things follow from how it works. The visitor’s browser loads Google’s script and talks to Google’s servers, so Google receives the IP address and the usual request headers. reCAPTCHA sets its _GRECAPTCHA cookie. When your server checks the token, it sends that token to Google and gets back a result or a score.

Under the GDPR an IP address and device information can be personal data, even without a name attached. That is why reCAPTCHA belongs in your privacy policy and your records of processing like any other service that handles visitor data.

What changed in April 2026 is what Google may do with the data. Under the Cloud terms it processes the data only to provide and maintain the service, and not for other purposes such as personalized advertising.

Does reCAPTCHA use cookies?

Yes. Google’s FAQ names a cookie called _GRECAPTCHA, describes it as necessary, and says it remains after the April 2026 change. Both reCAPTCHA v2 and v3 set it.

The label “necessary” is Google’s own classification. It tells you how Google sees the cookie, not how the rules on cookies apply to your site.

Does reCAPTCHA need consent?

This is the question most site owners ask, and there is no answer that fits every site. The yardstick is the ePrivacy rules on storing information in a visitor’s browser; in Germany that is § 25 TDDDG. Storing a cookie needs consent unless it is strictly necessary for a service the visitor has explicitly asked for. Whether a third-party bot check on your form meets that test is exactly the point on which opinions differ.

For the processing itself, operators usually look at legitimate interest under Art. 6(1)(f) GDPR, since protecting forms from bots is a security purpose. Whether that holds for your setup is part of the same review. This section is not legal advice; clear the consent question with your data protection officer.

What courts and regulators have said about reCAPTCHA

A court in Austria and the data protection authority in France have ruled on reCAPTCHA, and the published decisions so far point the same way: consent first, then reCAPTCHA.

In Austria, the Federal Administrative Court (BVwG) ruled on 13 September 2024 that the cookies reCAPTCHA set on a political party’s website were not technically necessary. Using reCAPTCHA there without the visitor’s prior consent was unlawful under the GDPR and Austria’s rules on storing information on a user’s device (BVwG reCAPTCHA ruling).

In France, the data protection authority CNIL fined Cityscoot €125,000 in March 2023, among other things for running reCAPTCHA at signup and login without informing users or asking for their consent. The exception for trackers that only secure a login did not apply, the CNIL found, because reCAPTCHA also enables analysis on Google’s part. In a later decision, SAN-2023-023, the CNIL confirmed that reCAPTCHA is not strictly necessary for site security, because it also serves analytics purposes, so consent is required.

Beyond individual cases, several European regulators have signaled that reCAPTCHA needs a clear consent mechanism, that legitimate interest alone may not justify it, and that loading it before consent is obtained is a problem. Regulators increasingly expect prior consent where cookies or similar technologies are involved, although positions still vary from country to country.

All of these decisions concern reCAPTCHA as it was used before 2 April 2026. Since then Google processes the data as your processor and only to provide and maintain the service, which bears on the CNIL’s point about analysis on Google’s part. The _GRECAPTCHA cookie, which the Austrian court looked at, is still set. How the new terms change the assessment for your site is a question for your data protection officer.

What a GDPR breach can cost

If an authority finds a breach, the GDPR allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious cases (Art. 83 GDPR). Authorities can also act on complaints from visitors and order changes to the processing. Embedding a vendor’s script does not move that responsibility to the vendor: as the controller, you answer for the tools on your site.

Is reCAPTCHA v3 GDPR compliant?

The same answer applies as for v2. v3 is the same Google service with the same _GRECAPTCHA cookie and the same processor terms. The visitor sees no challenge, and your server receives a score from 0.0 to 1.0 instead.

One difference matters in practice. Google suggests running v3 in the background of pages as well as on forms. Every page that loads it sends visitor requests to Google, so decide deliberately where you load it.

Data transfers to the US

reCAPTCHA data goes to Google, so the transfer question needs a legal review. For transfers outside the EU, the GDPR’s rules on international transfers apply, and for reCAPTCHA the document that covers them is Google’s Cloud Data Processing Addendum. Read it together with your data protection officer; we do not assess it for your site. In our view, reCAPTCHA stays a residual transfer risk for websites aimed at EU visitors, even with updated transfer frameworks.

This is the point where an EU CAPTCHA changes the picture: if the provider is an EU company and processes the data in the EU, the transfer question does not arise.

reCAPTCHA in your privacy policy

Anyone who uses reCAPTCHA has to name it in their privacy policy. Under Art. 13 GDPR that includes: who processes the data, for what purpose, on which legal basis, whether data goes to countries outside the EU and how long it is stored. We deliberately give no template, because the wording depends on your setup. This section is not legal advice; clear the wording with your data protection officer.

With TrustCaptcha there are no cookies and no transfer to the US. What belongs in your privacy policy for it is in the TrustCaptcha GDPR guide.

A GDPR-compliant alternative

If the cookie and the transfer are the two open points, the cleanest fix is a CAPTCHA that has neither. TrustCaptcha is built that way:

• It sets no cookies and builds no cross-site tracking profiles.
• It processes all CAPTCHA data in EU data centers.
• It includes a Data Processing Agreement for every customer.
• It deletes or anonymizes data automatically within a defined retention window.
• It checks visitors with proof-of-work on every plan, and adds bot detection and risk scoring from the Solo plan.

The visitor has nothing to solve, and your server validates the token as it would with reCAPTCHA. For the product view, see our GDPR-compliant CAPTCHA.

Try TrustCaptcha

Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free. Start your free trial and replace reCAPTCHA with a CAPTCHA that keeps visitor data in the EU.