Guides Tool check
Google reCAPTCHA & GDPR: Consent or alternative?
Google reCAPTCHA protects forms from bots - but collects a lot of data and sends it to Google. What this means for data protection.
What reCAPTCHA collects
reCAPTCHA (v2/v3) analyses user behaviour and transmits data such as IP addresses, browser data and user interactions to Google.
reCAPTCHA v3, in particular, often runs in the background on all pages and continuously evaluates visitors. This raises data protection concerns, as it goes far beyond mere bot prevention.
Do I need consent?
If reCAPTCHA is loaded before the user gives their consent, consent is usually required – otherwise there is the same risk as with other Google services.
At the very least, reCAPTCHA must be mentioned in the privacy policy. If it is activated as soon as the page is loaded (typically with v3), it should be loaded on a consent basis or replaced.
Data protection-friendly alternatives
There are anti-bot solutions that do not involve sending data to Google – such as hCaptcha (EU options), Friendly Captcha or server-side methods like honeypots.
Friendly Captcha (made in Germany) and honeypot fields in particular often solve the problem without the need for a cookie banner – ideal for streamlined, legally compliant forms.
Check what loads on your page
Not sure whether reCAPTCHA runs before consent is given?
The free BlueOcean scan shows whether reCAPTCHA and other Google services load before consent is given – so you can make targeted improvements.
Let's take a quick look at your sites
In a 15-minute call you’ll see where your client sites stand — and how to secure them effortlessly.
FAQ
Is reCAPTCHA GDPR compliant?
Only with consent (if it loads before consent is given) and a reference in the privacy policy. v3 is particularly problematic because it runs continuously in the background.
Are there alternatives without Google?
Yes: Friendly Captcha, hCaptcha with EU options, or honeypot fields offer bot protection with significantly lower data privacy risks.
Does reCAPTCHA have to be included in the privacy policy?
Yes, the use of reCAPTCHA and the transfer of data to Google must be disclosed.