Is Google reCAPTCHA GDPR-compliant? What website owners need to check
Updated:
Quick answer
Whether reCAPTCHA is GDPR-compliant depends on your setup, and there is no blanket yes. Three questions decide it: does the widget store or read information on the visitor’s device (consent under § 25 TDDDG / ePrivacy), is personal data transferred outside the EU, and do you have a valid legal basis and data processing agreement. Many website owners avoid the question by using a cookie-free, EU-hosted alternative. This is general information, not legal advice.
Why is reCAPTCHA a data protection question at all?
reCAPTCHA is operated by Google. When you embed it, the visitor’s browser loads a script from a Google domain and sends information about the request and the browser to Google so that it can judge whether the visitor is a bot.
That raises two separate legal questions: the GDPR for the personal data processed, and the ePrivacy rule (in Germany § 25 TDDDG) for anything stored on or read from the visitor’s device.
The three questions to answer
| Question | Why it matters | What to check |
|---|---|---|
| Does the widget store or read information on the device? | Under § 25 TDDDG, this generally needs consent unless it is strictly necessary for a service the visitor requested. | Use browser developer tools to list cookies and local storage before and after the widget loads. |
| Is personal data sent outside the EU? | Transfers need a valid mechanism under Chapter V of the GDPR. | Read the provider’s data processing terms: which entity, which country, which transfer mechanism. |
| Do you have a legal basis and a DPA? | Art. 6 GDPR requires a basis (often legitimate interest for security) and Art. 28 a processing agreement. | Document the basis, sign the agreement, and name the provider in your privacy policy. |
What does this mean in practice?
Many German data protection authorities and legal advisers treat embedding a third-party widget that reads or writes information on the device as requiring consent. If you take that view, the CAPTCHA must be blocked until a visitor accepts, which means visitors who decline cannot use the form.
You can run a consent banner and load reCAPTCHA only after consent, or you can choose a CAPTCHA that does not store anything on the device and is processed in the EU. Which route is right is a decision for you and your data protection officer.
Checklist for a privacy-friendly alternative
- No cookies, no local storage and no fingerprint stored on the device, confirmed in the documentation and in your own test.
- Processing in the EU, with the hosting country and sub-processors named.
- A data processing agreement available before sign-up.
- No profile of the visitor, only the signals needed to tell bots from people.
- No puzzle that locks out people who use assistive technology (WCAG 2.2, 3.3.8).
- An API that matches what you already use, so switching is cheap.
Where BurgCaptcha fits
BurgCaptcha runs a proof-of-work task in the browser, sets no cookies and is hosted in Germany on every plan. Its API answers in the reCAPTCHA response format, so replacing reCAPTCHA means changing a script URL, a site key and a secret.
There is a free plan for up to 1,000 requests a month. Please confirm your own setup with your data protection officer.
Frequently asked questions
Is reCAPTCHA illegal in the EU?
No. It is not banned, but using it lawfully requires a legal basis, a data processing agreement, a valid transfer mechanism for data leaving the EU and, where it stores or reads information on the device, consent. Check your setup with your data protection officer.
Do I need a cookie banner for reCAPTCHA?
Many authorities and advisers say yes, because the widget interacts with the visitor’s device. A CAPTCHA that stores nothing on the device usually avoids that consent entry.
Is a CAPTCHA a legitimate interest under GDPR?
Securing a website against abuse can be a legitimate interest under Art. 6(1)(f) GDPR, but that covers the personal data processing only. It does not replace consent where the ePrivacy rule on device storage applies.
What is a GDPR-friendly reCAPTCHA alternative?
One that sets no cookies, processes data in the EU, offers a data processing agreement and does not build visitor profiles. BurgCaptcha is built to that checklist.