reCAPTCHA vs hCaptcha and which one is more privacy-friendly

hCaptcha collects less data than Google reCAPTCHA: it does not feed an advertising network or link challenges to a Google account, while reCAPTCHA v3 scores visitors from their behaviour on every page where it loads. Both store something on the visitor's device, so under Article 5(3) of the ePrivacy Directive a CAPTCHA needs cookie consent unless its storage is strictly necessary for the form the visitor is submitting. For reCAPTCHA that exemption is hard to argue, so most sites hold it back until consent.

Two CAPTCHAs, two privacy models

Bot protection is a basic requirement for any website that accepts form submissions, runs a login page, or processes payments. The two most widely deployed CAPTCHA services, Google reCAPTCHA and hCaptcha, take fundamentally different approaches to user data.

Google reCAPTCHA, particularly version 3, works by continuously analysing user behaviour across the page. It scores visitors based on mouse movements, scroll patterns, browsing history, and device characteristics. hCaptcha, built by Intuition Machines, positions itself as a privacy-first alternative that minimises data retention and avoids cross-site tracking.

Both services set cookies on your visitors' devices. That single fact triggers obligations under Article 5(3) of the ePrivacy Directive and, depending on how the cookies are classified, may require prior consent before the CAPTCHA loads.

The cookies reCAPTCHA sets

reCAPTCHA v2 and v3 rely on Google's broader cookie infrastructure. When a visitor loads a page with reCAPTCHA, the following cookies typically appear:

SIDCC, HSID, SID and APISID belong to the visitor's Google account session, not to reCAPTCHA. They are sent along with requests to google.com only for visitors who are signed in to Google. Google's reCAPTCHA FAQ says reCAPTCHA "sets a necessary cookie (_GRECAPTCHA) when executed for the purpose of providing its risk analysis", and that loading it from www.recaptcha.net instead of www.google.com avoids the other cookies google.com may set.

The _GRECAPTCHA cookie itself stores a unique identifier that Google uses to build a behavioural fingerprint. Because reCAPTCHA operates within Google's ecosystem, visitors who are logged into a Google account may have their CAPTCHA interactions linked to their broader browsing profile.

As of October 2026, that FAQ carries a banner saying the page is deprecated and pointing to Google Cloud Fraud Defense, where reCAPTCHA now lives with its own migration path. Google still publishes no separate privacy policy for reCAPTCHA itself. Website operators struggle to tell visitors exactly what data is collected, which makes the information obligations of Article 13 GDPR in your privacy policy harder to meet.

The cookies hCaptcha sets

hCaptcha sets fewer cookies and says they fall within the "strictly necessary" exemption. hCaptcha's privacy and cookie policy lists these as its main ones:

hCaptcha states it does not use cookies for advertising or cross-site tracking. Its policy says cookie and analytics data is discarded as soon as practical, but may be kept for up to one year after the cookie expires.

That said, hCaptcha still collects IP addresses, browser metadata, mouse movements, interaction timing, and gyroscopic data (on mobile devices). This data is processed by Intuition Machines, Inc., a US-based company, which means cross-border data transfer rules apply for EU visitors. Intuition Machines states that it complies with the EU-US Data Privacy Framework, which has provided a transfer mechanism since the European Commission's adequacy decision in 2023, and its policy also names Standard Contractual Clauses for EU data.

Data collection side by side

The scope of data each service processes differs significantly.

reCAPTCHA v3 is particularly data-hungry because it runs continuously in the background. Unlike v2 (the "I'm not a robot" checkbox), v3 never presents a visible challenge. It silently monitors behaviour across every page where the script is loaded, collecting data that goes well beyond what is needed to distinguish a bot from a human.

Does a CAPTCHA need cookie consent?

This is where many website operators get it wrong. The assumption that bot protection cookies are "strictly necessary" and therefore exempt from consent does not hold up under scrutiny for reCAPTCHA.

Article 5(3) of the ePrivacy Directive exempts cookies that are "strictly necessary" for a service explicitly requested by the user. A CAPTCHA on a contact form could arguably meet this test: the user is submitting the form, and bot protection supports that action. But reCAPTCHA v3 loads on every page, not just forms. And the cookies it sets serve purposes beyond bot detection, including Google's own advertising and analytics functions.

French enforcement has touched reCAPTCHA. The CNIL fined the scooter-sharing company Cityscoot 125,000 euros in March 2023 (deliberation SAN-2023-003), mainly over the geolocation of its vehicles, and the decision is reported to have also covered reCAPTCHA loaded without information or consent.

hCaptcha's position is stronger. If its cookies genuinely qualify as strictly necessary (session-based, no tracking, no advertising), they may fall within the consent exemption. But "may" is not "definitely." Some data protection authorities take the view that any third-party service setting cookies warrants at least a disclosure, and many sites obtain consent before loading any external script.

Where each service stands under the GDPR

Under GDPR, both reCAPTCHA and hCaptcha process personal data (IP addresses, device identifiers, behavioural data). The website operator is the data controller and must identify a lawful basis for processing.

For reCAPTCHA, legitimate interest is the most commonly cited basis. But legitimate interest requires a balancing test (Article 6(1)(f)), and extensive behavioural tracking for bot detection is hard to justify when less invasive alternatives exist. The fact that hCaptcha achieves comparable bot protection with less data collection weakens the "necessity" argument for reCAPTCHA.

Google's role as a data processor (or potentially joint controller, depending on the configuration) adds complexity. The lack of a dedicated reCAPTCHA privacy policy makes it harder for website operators to complete a Data Protection Impact Assessment, which may be required given the scale of data processing involved.

hCaptcha publishes a detailed privacy policy. It acts as a processor for the sites that embed it and offers a Data Processing Addendum. Its Data Privacy Framework participation and the Standard Contractual Clauses give EU transfers a recognised mechanism.

What the choice changes on your website

Choosing between reCAPTCHA and hCaptcha affects more than compliance paperwork. It changes how your cookie banner must work.

If you use reCAPTCHA, you should treat it as a non-essential service and block the script until the visitor grants consent. This means your forms, login pages, and checkout flows are unprotected until consent is given, a genuine security trade-off. You can mitigate this by using server-side rate limiting or honeypot fields as a fallback for visitors who decline cookies.

If you use hCaptcha, you may be able to load it without prior consent if you can demonstrate the cookies are strictly necessary. But you still need to disclose the service in your cookie policy and privacy policy, and document your reasoning for the strictly necessary classification.

Both services require you to list them in your third-party vendor register and ensure a Data Processing Agreement is in place.

Limits and alternatives matter too. reCAPTCHA's free tier now runs through Google Cloud, which the FAQ describes as up to 10,000 assessments per month at no cost, and hCaptcha has its own free and paid tiers. Other options include Cloudflare Turnstile and self-hosted measures such as honeypot fields and rate limiting. Whichever you pick, check what it stores on the device before deciding whether it can load before consent.

reCAPTCHA v3 and browser fingerprinting

reCAPTCHA v3's continuous behavioural analysis goes beyond traditional cookies. It collects screen resolution, installed plugins, language settings, and rendering characteristics, data points that constitute browser fingerprinting.

The CNIL has explicitly stated that fingerprinting falls under Article 5(3) of the ePrivacy Directive and requires consent unless strictly necessary. Running reCAPTCHA v3 site-wide, on pages where no user interaction requires bot protection, is difficult to justify as strictly necessary.

Which CAPTCHA to choose

From a pure privacy standpoint, hCaptcha is the less invasive option. It collects less data, does not feed into an advertising network, and documents its processing more clearly. For websites subject to GDPR or the ePrivacy Directive, its consent position is easier to explain.

reCAPTCHA v3 offers strong bot detection powered by Google's vast data network, but that strength is also its privacy weakness. The volume of data it processes, the opacity of Google's privacy disclosures, and the enforcement actions by the CNIL all point to more risk under the consent rules.

If you do choose reCAPTCHA, limit it to pages where bot protection is genuinely needed (forms, login, checkout) rather than deploying it site-wide. Google Consent Mode does not govern reCAPTCHA, so the only control is to block the reCAPTCHA script until consent is granted.

CAPTCHA consent questions

Find out what your CAPTCHA sets before anyone chooses

If you are not sure which cookies your forms set, scan the page. The Cookie scanner lists every cookie a page sets on load, including _GRECAPTCHA and any Google cookies that come with it.

Scan your website