reCAPTCHA v2 vs v3: Differences and Which to Use

What is the difference between reCAPTCHA v2 and v3?

reCAPTCHA v2 asks the visitor to prove something: tick the “I’m not a robot” box and, if Google is unsure, solve an image challenge. reCAPTCHA v3 asks nothing. It runs in the background and returns a score from 0.0 (very likely a bot) to 1.0 (very likely a human), and your server decides what to do with it.

Is reCAPTCHA v3 better than v2?

Not in general. v3 is better for your visitors and more work for you. It removes the puzzle, but it hands you a number instead of a decision, and you have to build what happens below the threshold: block, ask for email verification, send the request to a second check. v2 makes that decision for you and is done in an afternoon, at the price of a visible step that some visitors fail.

For one contact form, v3 is more machinery than the problem needs. For a shop with login, checkout and account pages, v2’s yes or no is too blunt, and v3’s score per action earns its keep.

Some teams combine the two: v3 on every page, and a v2 challenge only for low scores. Google now sells that in one key. Policy-based challenge keys, generally available since 28 October 2025, show a challenge when the score falls below a threshold you set.

How reCAPTCHA v2 works

The visitor clicks the checkbox. Behind that click Google looks at signals from the browser and the session; it does not publish the full list. If it is confident, the box turns green. If not, the visitor gets an image grid (“select all traffic lights”) and sometimes a second one. Since July 2026 Google also offers a QR code challenge, which it describes as harder for AI to solve.

The invisible variant works the same way without the checkbox. It runs when the visitor presses the submit button and shows a badge in the corner of the page. It can still show an image challenge if the risk analysis is unsure.

Either way, your server receives a token and checks it with Google. The answer is valid or not. That is v2’s strength and its limit: easy to use, nothing to tune, and no way to tell a slightly odd visitor from a bot farm.

Image challenges are also where v2 loses people. They interrupt the form, they are fiddly on phones, and visitors who are blind or have low vision cannot solve them. CAPTCHA farms, on the other hand, solve them for a few cents.

How reCAPTCHA v3 works

You load the v3 script on your pages and name each action you want scored, such as login or checkout. Google’s documentation asks for action names made of letters, numbers, slashes and underscores, and nothing user-specific. For every action the script requests a token, your server sends it to Google and gets back a score.

1.0 means the interaction is very likely good, 0.0 that it is very likely a bot. Google’s v3 documentation suggests 0.5 as a default threshold. Its newer Google Cloud documentation is more careful: run v3 without blocking first, look at the scores your real visitors get, then decide per action.

One detail many guides miss: on the free Essentials tier the score only takes four values, 0.1, 0.3, 0.7 and 0.9. Premium and Enterprise return eleven levels. If you plan fine-grained rules, the free tier will not give you the resolution for them.

v3 never shows a challenge, so everything below your threshold is your problem to handle. Google suggests a second factor or email verification. That is fair advice, and it is also the work that makes v3 more expensive to run than its price suggests. If you want to understand what a reCAPTCHA score measures and how other bot scores compare, we explain it separately.

The classic v3 developer page is now marked as deprecated and points to the Google Cloud Fraud Defense documentation. v3 keys keep working; the documentation simply lives somewhere else now.

reCAPTCHA v3 vs Enterprise

The question is confusing because the names changed. “reCAPTCHA Enterprise” used to be the name of the whole Google Cloud product. Since 22 April 2026 reCAPTCHA is part of Google Cloud Fraud Defense, which Google’s terms call “formerly reCAPTCHA Enterprise”, and Enterprise now names the top pricing tier.

v3 is a key type: a score key. Essentials, Premium and Enterprise are tiers. So the real question is what the paid tiers add to the same score:

• Premium and Enterprise return eleven score levels instead of four.
• Account defense, plus password, SMS and transaction defense, each of which costs an extra assessment.
• A policy engine, limited to three rules on Premium.
• On Enterprise only: dedicated account management, a customer-specific fraud report and attack investigation.

Enterprise is also a different commitment. Premium is billed monthly as you go; Enterprise is a fixed monthly volume at $1 per 1,000 assessments with a minimum term of 12 months. What that means at 50,000 or two million requests a month is in our breakdown of reCAPTCHA pricing.

What changed for both versions in 2025 and 2026

Whether you run v2 or v3, four changes apply to you.

Classic keys moved into Google Cloud. Google stopped issuing new classic keys in 2024, started migrating existing ones into Google Cloud projects in the last quarter of 2025 and finished in the first quarter of 2026. Keys without a Google Cloud project lost API access. Existing v2 and v3 site keys keep working after the migration.

Everything is an assessment. v2 checkbox, v2 invisible and v3 checks are all billed the same way: 10,000 free a month per organization, counted across all your accounts and sites, then paid.

Over the limit, it fails open. If you go past the free tier without a billing account, the classic verify call still answers with success and a score of 0.9, plus an error message. In plain words: your form keeps accepting every request as human. If your traffic is anywhere near 10,000 checks a month, look for that error in your logs.

Google became a processor on 2 April 2026. You are now the sole controller of the data, and Google processes it under its Cloud Data Processing Addendum. The badge no longer links to Google’s privacy policy and terms; if you added those links to your own site because of reCAPTCHA, Google asks you to remove them. The _GRECAPTCHA cookie stays.

What both versions mean for GDPR

On privacy there is little difference between v2 and v3. Both set the same cookie, both send signals from the visitor’s browser to Google, and both run under the same terms. Google does not publish the full list of signals, and transfers to Google need a legal review. v3 tends to collect more simply because Google recommends loading it in the background of many pages, not just on the form.

Google’s own FAQ answers “Is Fraud Defense GDPR compliant?” with yes, based on its Cloud Data Processing Addendum. That settles Google’s side of the contract. Whether your site needs consent for the cookie and the device signals, and how you justify the processing, is a legal question for your setup, and one for your data protection officer. We go through the arguments in Is reCAPTCHA GDPR compliant?.

Regulatory scrutiny has grown in recent years, above all of data collected before the visitor has consented. A growing number of countries, particularly in the EU, require explicit consent before reCAPTCHA is used, because of its cookies and its analysis of visitor behavior; courts and data protection authorities in Austria and France have ruled that way. Where consent is required, reCAPTCHA cannot load without it, so the form behind it may stop working for visitors who decline, and that can cost you customers. Several governments and public bodies recommend considering alternatives to reCAPTCHA, and TrustCaptcha is one such alternative. These positions concern reCAPTCHA as it was used before Google became a processor on 2 April 2026; the _GRECAPTCHA cookie is still set.

When neither version fits

reCAPTCHA is still the default in many frameworks and plugins, which is why so many sites never question it. But if the problem is the cookie, the dependency on Google or the puzzle itself, switching from v2 to v3 does not solve it. Our comparison of reCAPTCHA alternatives covers the main options on privacy, data location, user friction and price.

TrustCaptcha: invisible, cookie-free, hosted in the EU

TrustCaptcha takes the part of v3 that visitors like, no task at all, and drops the parts that cause trouble. The browser solves a proof-of-work puzzle in the background, and the bot score decides how hard that puzzle gets: a normal visitor pays a moment of computing time, a suspicious request pays a lot more. Your server validates the token and gets the bot score back, and you can add security rules of your own on top.

There are no cookies, data is processed in EU data centers, and every customer gets a Data Processing Agreement.

Try TrustCaptcha

Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free. Start your free trial and replace the checkbox, or the score you never got around to tuning, with a check your visitors never see.