If you run a website with EU visitors and use Google reCAPTCHA, the short answer is uncomfortable: using reCAPTCHA without asking for consent has already been sanctioned by a European regulator, and obtaining that consent largely defeats the point of having a CAPTCHA. Here's the actual state of play — what regulators have said, what reCAPTCHA collects, and what your realistic options are.
This article is general information, not legal advice. For decisions about your own compliance, talk to a lawyer.
What reCAPTCHA actually collects
reCAPTCHA works by judging whether a visitor "looks human," and to do that it gathers signals from their browser: device and browser characteristics, mouse movements, cookies Google has previously set on the device, and the visitor's IP address. That data is transmitted to Google's servers, and reCAPTCHA reads and writes information on the visitor's device — which matters legally, because storing or accessing information on a user's device is regulated separately from the GDPR by the ePrivacy rules that member states have written into national law.
Google does not fully document what the risk score is computed from, which is itself part of the compliance problem: it's difficult to write an accurate privacy notice about processing you can't fully describe.
What regulators have actually said
The most concrete precedent comes from France. In 2023, the French data-protection authority (CNIL) fined the scooter-rental company Cityscoot €125,000, and among the violations was its use of Google reCAPTCHA without collecting users' consent. The CNIL's position was that reCAPTCHA reads and writes information on users' devices for purposes that are not strictly necessary for providing the service the user asked for — so under Article 82 of the French Data Protection Act (France's implementation of the ePrivacy rules), consent was required, and "fraud prevention" did not exempt it.
That reasoning isn't unique to one case or one country. Any EU supervisory authority applying the same ePrivacy logic — device access that isn't strictly necessary requires prior consent — reaches the same conclusion, and the CNIL has repeated its position in published guidance.
On top of the consent question sits the data-transfer question: reCAPTCHA sends data to Google, a US company. Since the Schrems II ruling struck down Privacy Shield in 2020, EU–US transfers have been legally turbulent. The current EU–US Data Privacy Framework (2023) does provide a legal basis, and Google is certified under it — but the framework has faced legal challenges from the start, and many EU privacy teams treat any dependency on it as a risk to be minimized rather than a problem solved.
Why "just get consent" doesn't work for a CAPTCHA
For a cookie banner, consent is annoying but workable. For a CAPTCHA, it's close to self-defeating:
- You can't load reCAPTCHA until the visitor consents. A form that only gets bot protection after the visitor clicks "accept" is a form without bot protection — bots don't click accept, they skip the banner and POST directly to your endpoint.
- Refusing consent has to be honored. If a legitimate user declines, you must either let them submit the form unprotected or block them from a service they're entitled to use — the second option creates its own GDPR problem, because consent that gates access isn't freely given.
- Consent doesn't fix the transparency problem. You're asking users to consent to processing that Google doesn't fully disclose, which makes truly informed consent hard to argue.
This is why the practical advice from EU privacy professionals has been converging for years: don't try to paper over reCAPTCHA with a banner — use a CAPTCHA that doesn't need one.
What a GDPR-friendly CAPTCHA looks like
The compliance problems above come from three design choices: behavioral profiling, cross-site cookies and device fingerprinting, and shipping visitor data to an ad-tech company. A CAPTCHA avoids the problems by not making those choices:
- No cookies, no device fingerprinting. Nothing is read from or written to the visitor's device beyond what's strictly necessary to deliver the challenge — which keeps it outside the ePrivacy consent trap that caught Cityscoot.
- No behavioral profiling. Prove the visitor is human with something that doesn't require building a profile of them — for example a proof-of-work challenge their browser solves invisibly, which costs a bot CPU time instead of costing the visitor their privacy.
- Minimal, transient data. The visitor's IP address is processed briefly for abuse prevention — a textbook legitimate-interest purpose — and not used to track anyone across sites.
Several products in this category exist, including CaptchaTool (ours), Friendly Captcha, and others built specifically for the EU market. Cloudflare Turnstile also markets itself as privacy-preserving, though it still routes your visitors through a large US infrastructure provider — a meaningful difference for teams minimizing their transfer exposure. We compare the options honestly — including where competitors beat us — in reCAPTCHA alternatives in 2026.
The practical checklist
If you're auditing a site for EU exposure today:
- Find every form using reCAPTCHA — contact forms, signups, logins, checkout.
- Check whether it loads before consent. If reCAPTCHA runs for EU visitors who haven't consented, that's the exact pattern the CNIL sanctioned.
- Weigh the honest options. Gate reCAPTCHA behind consent and accept unprotected forms for everyone who declines — or switch to a CAPTCHA that doesn't require consent at all.
- Update your privacy notice to describe whatever you end up running. With a no-tracking CAPTCHA that's a short, accurate paragraph rather than a caveat-laden one.
The bottom line
reCAPTCHA can be made defensible in the EU only by wrapping it in a consent flow that undermines its purpose and still leaves the transfer question open. That's why the pragmatic answer to "is reCAPTCHA GDPR compliant?" is: not in the way most sites deploy it — and the cleanest fix is a CAPTCHA that was designed so the question doesn't come up.
CaptchaTool is a privacy-first CAPTCHA: one script tag, no cookies, no fingerprinting, no behavioral profiling, and a free tier to start. See how it works →