GDPR-compliant CAPTCHA

TrustCaptcha is a GDPR-compliant CAPTCHA from Munich. It checks visitors without cookies and without tracking, processes the data in EU data centers and includes a Data Processing Agreement for every customer. It is free for non-commercial sites, and every plan starts with a 14-day free trial.

Start Free Trial Contact Sales

Data minimization

What data TrustCaptcha processes

TrustCaptcha only processes what it needs to tell people from bots, and only for that purpose. The data is never used for marketing or to build profiles across websites.

Request data — IP address, timestamp, headers and referrer.
Device and browser data — the characteristics bot detection needs.
Interaction signals — for example click patterns and mouse movements that reveal automation.
Repetition indicators — for example many CAPTCHAs started in a short time.
Short retention — verification data is kept for 48 hours by default, and at most 7 days; after that it is deleted or anonymized.

The full list of data categories, the lawful basis most customers use and what belongs in your privacy policy are in the TrustCaptcha GDPR guide.

What TrustCaptcha processes: request data, device and browser data, interaction signals and repetition indicators, kept for 48 hours by default and up to 7 days, then deleted or anonymized; no cookies and no tracking profiles

Do I need consent for TrustCaptcha?

TrustCaptcha sets no cookies, builds no tracking profiles and uses the data only for bot protection. That removes the usual reasons a CAPTCHA ends up behind a consent banner, such as cookies or use of the data for other purposes.

Whether your setup needs consent is still a legal question, and the answer depends on how you use TrustCaptcha. This section is not legal advice; clear it with your data protection officer.

Where the data is processed

All TrustCaptcha data is processed and stored in EU data centers on ISO 27001-certified infrastructure. There are no transfers to third countries, so the transfer questions that come with US providers do not arise. TrustCaptcha is an EU CAPTCHA, developed in Germany and hosted in the EU.

Contract

A Data Processing Agreement for every customer

Trustcaptcha GmbH processes CAPTCHA data on your behalf as a processor under Art. 28 GDPR. You stay the controller and decide where and why TrustCaptcha runs.

Included for every customer — by default, which keeps procurement and legal review short.
What it covers — processing instructions, confidentiality, security measures, sub-processor conditions, support with data subject requests and DPIAs, and deletion when the service ends.
Security measures — encryption in transit, access controls, monitoring and separated environments.

You can read the Data Processing Agreement before you sign up.

Where the data goes: the visitor's browser solves the proof-of-work without cookies, TrustCaptcha checks it in EU data centers, your server validates the token; no transfer to third countries and a DPA for every customer

Comparison

TrustCaptcha vs reCAPTCHA on GDPR

Since 2 April 2026 Google processes reCAPTCHA data as a processor, which settles one old question. The cookie and the transfer question remain.

	Google reCAPTCHA	TrustCaptcha
Provider's role	Processor under the Google Cloud Data Processing Addendum (since 2 April 2026)	Processor under the TrustCaptcha DPA
Cookies	Sets the _GRECAPTCHA cookie, which Google labels necessary	None
Where data is processed	Varies, needs a legal review	EU data centers
Company based in	USA	Germany (Munich)
Contract	Google Cloud Data Processing Addendum	DPA for every customer

The details, including what Google's change means for your privacy policy, are in Is reCAPTCHA GDPR compliant? Other options are compared in reCAPTCHA alternatives.

Case law

What courts and regulators said about reCAPTCHA

A court in Austria and the data protection authority in France found that reCAPTCHA needed the visitor's consent. The decisions concern reCAPTCHA as it was used before 2 April 2026, when Google became a processor; the _GRECAPTCHA cookie is still set.

Austria: consent before reCAPTCHA cookies

In a ruling of 13 September 2024, Austria's Federal Administrative Court (BVwG) held that the cookies reCAPTCHA set on a political party's website were not technically necessary. Using reCAPTCHA without prior consent was unlawful under the GDPR and Austria's rules on storing information on a user's device.

Source: BVwG reCAPTCHA ruling

France: consent for reCAPTCHA at login

In March 2023 the French data protection authority CNIL fined Cityscoot €125,000, among other things for running reCAPTCHA at signup and login without consent. The exception for trackers that only secure a login did not apply, because reCAPTCHA also enables analysis on Google's part.

France: not strictly necessary

In decision SAN-2023-023 the CNIL confirmed that reCAPTCHA is not strictly necessary for site security, because it also serves analytics purposes, so consent is required.

Source: CNIL decision SAN-2023-023

Fines for the most serious GDPR breaches can reach €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83 GDPR). As the controller you answer for the tools on your site, whichever vendor provides them. What these decisions mean for your setup is a legal question; this is not legal advice, so clear it with your data protection officer.

Trusted by companies, organisations and governments.

FAQ

Questions about GDPR and TrustCaptcha

What is a GDPR-compliant CAPTCHA?

A CAPTCHA built so that you can use it under the GDPR without extra hurdles: it processes only the data needed for bot protection, sets no cookies, keeps the data in the EU, deletes it after a short time and comes with a Data Processing Agreement. Whether your own use is compliant also depends on your setup and your privacy policy.

Is TrustCaptcha GDPR compliant?

TrustCaptcha is built for use under the GDPR: it sets no cookies, builds no tracking profiles, uses the data only for bot protection, processes it in EU data centers and includes a Data Processing Agreement for every customer. You remain the controller and document your lawful basis and privacy policy.

Does TrustCaptcha use cookies?

No. TrustCaptcha does not set any cookies. Your website may still use cookies for other purposes.

Do I need a cookie banner for TrustCaptcha?

TrustCaptcha sets no cookies and does not track visitors, which removes the usual reason for a consent banner. Whether your setup needs consent is a legal question; this is not legal advice, so clear it with your data protection officer.

Where is the data processed?

All TrustCaptcha data is processed and stored in EU data centers on ISO 27001-certified infrastructure, with no transfers to third countries.

Is there a Data Processing Agreement?

Yes. Every customer gets a Data Processing Agreement (DPA) under Art. 28 GDPR. It covers processing instructions, confidentiality, security measures, sub-processors, support with data subject requests and deletion when the service ends.

Bot protection without cookies, processed in the EU. Try TrustCaptcha.

EU-hosted & GDPR-compliant
No puzzles
Try free for 14 days

Get started Contact sales