Cookie-free CAPTCHA: why it matters and how to check
Updated:
Quick answer
A CAPTCHA that sets no cookies and stores nothing on the visitor’s device generally does not need a consent entry for that purpose, because the ePrivacy rule (in Germany § 25 TDDDG) is triggered by storing or reading information on the device. You can verify a widget yourself in the browser developer tools. This is general information, not legal advice: confirm your setup with your data protection officer.
How to test any CAPTCHA widget in five minutes
- Open a page that uses the widget in a private window and open the browser developer tools.
- In Application (Chrome) or Storage (Firefox), check Cookies, Local Storage, Session Storage and IndexedDB before and after the widget loads.
- In the Network tab, list every domain the page contacts once the widget is active and note which ones are new.
- Read the provider’s documentation and data processing agreement for what the server stores, for how long, and in which country.
- Write down the result and give it to your data protection officer.
What to ask a provider
| Question | What a good answer looks like |
|---|---|
| Does the widget set cookies or use local storage? | No, and it is confirmed in the documentation. |
| Does it fingerprint the device? | No profile of the person is created; only signals needed to tell bots from humans. |
| Where is data processed? | In the EU, with the country and the sub-processors named. |
| Is a data processing agreement available? | Yes, public or sent before signup. |
How BurgCaptcha handles it
BurgCaptcha checks the browser, not the person. A proof-of-work task runs in the background, the widget sets no cookies and saves no fingerprint, and hosting is in the EU on every plan.
Frequently asked questions
Do I need a cookie banner for a CAPTCHA?
Only if the CAPTCHA stores or reads information on the visitor’s device in a way that is not strictly necessary. A widget that sets no cookies and stores no identifier usually needs no consent entry for that purpose. Confirm with your data protection officer.
Is a cookie-free CAPTCHA automatically GDPR-compliant?
No. Avoiding cookies addresses the device-storage rule. You still need a legal basis, a data processing agreement and a view on where data is processed.
Which German law covers cookies?
§ 25 TDDDG, which implements the ePrivacy rule on storing and reading information on end devices. The GDPR applies to the personal data processing that follows.