GDPR-Compliant CAPTCHA 2026: 8 Providers Checked

No CAPTCHA is "GDPR compliant" on its own. Compliance is a property of how you use it: what you tell visitors, what legal basis you rely on and what contract you have with the vendor. What a vendor can do is make that easy or hard. A CAPTCHA that sets a tracking cookie, sends IP addresses to a country without an adequacy decision and reuses the data for its own purposes leaves you with a consent banner entry and a transfer assessment. One that sets nothing on the device and processes data in the EU as your processor leaves you with a line in your privacy notice.

This guide sets out six tests and applies them to eight CAPTCHAs: Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, Friendly Captcha, ALTCHA, MTCaptcha, captcha.eu and Prosopo Procaptcha. We are not lawyers and this is not legal advice. We make Procaptcha, so weigh our view of it accordingly. Every vendor fact links to the vendor's own page, checked on 2 November 2026.

For the practical steps once you have picked a vendor, see how to make CAPTCHA GDPR compliant.

Six tests for a GDPR-friendly CAPTCHA

1. Does the CAPTCHA set cookies or read the device?

This is an ePrivacy question rather than a GDPR one. Article 5(3) of the ePrivacy Directive, implemented in France by Article 82 of the Loi Informatique et Libertés and in Germany by § 25 TDDDG, requires consent before storing or reading anything on a visitor's device, unless it is strictly necessary for a service the visitor asked for.

The CNIL, France's regulator, answers the CAPTCHA question directly in question 17 of its cookie FAQ. A CAPTCHA whose sole purpose is securing the site or a login needs no consent. A CAPTCHA whose provider also uses the data for other purposes does need consent, and the CNIL gives "la solution reCAPTCHA de la société Google" as an example of a provider that says it reuses data for its own account. The CNIL also points out that a CAPTCHA behind a consent banner does not work, because a visitor who refuses consent skips the check, and it recommends alternatives that need no consent.

2. Is the vendor your processor, with a DPA?

Under Article 28 GDPR, a vendor that processes personal data only on your instructions is a processor and must sign a data processing agreement with you. A vendor that decides for itself what to do with the data is a controller, and you then have to explain to visitors that their data goes to a third party for that party's purposes.

3. Does personal data leave the EU, and on what basis?

A CAPTCHA always processes the visitor's IP address, which is personal data. If it goes to the US, the transfer needs a legal basis under Chapter V GDPR. Since the European Commission's adequacy decision of 10 July 2023, transfers to US companies certified under the EU-US Data Privacy Framework are covered. The EU General Court upheld that decision on 3 September 2025 in Latombe v Commission (T-553/23), and an appeal to the Court of Justice is possible. Its two predecessors, Safe Harbour and Privacy Shield, were both struck down, so many EU organisations prefer a vendor that keeps data in the EU and does not depend on it.

4. Where is data processed?

Separate from the legal basis, check the physical location. Several vendors serve requests from a global network by default and offer EU-only processing as a paid option.

5. How long is data kept?

Article 5(1)(e) GDPR requires that personal data is kept no longer than necessary. A CAPTCHA needs the data for seconds to decide, and longer only for abuse investigation and billing.

6. Does the CAPTCHA fingerprint or profile visitors across sites?

Every CAPTCHA collects signals from the browser to tell a person from a bot. The GDPR question is whether those signals are used only to make that decision on your site, or combined into a profile of the same person across every site that uses the vendor.

Eight CAPTCHAs scored

"Not published" means we could not find the answer on the vendor's own site.

Each vendor against the tests

Google reCAPTCHA

Google's reCAPTCHA FAQ says that from 2 April 2026 customers are "the sole data controller of Customer Data" and Google processes it under the Cloud Data Processing Addendum. That fixes test 2 on paper. The _GRECAPTCHA cookie "remains", Google describes it as necessary, and the CNIL's FAQ still names reCAPTCHA as a CAPTCHA that needs consent. Transfers rely on Google LLC's Data Privacy Framework certification. For the background, read Google reCAPTCHA is now a data processor.

Verdict: usable with a consent banner entry and a transfer record, but the CNIL's point applies: a visitor who refuses consent is not checked.

hCaptcha

hCaptcha's GDPR page says it is "not the controller of the End User personal data it processes", that its terms include a standard DPA with Standard Contractual Clauses, and that it is enrolled in the EU-US, UK-US and Swiss-US Data Privacy Frameworks. Its privacy policy lists a first-party hmt_id cookie lasting 30 days for service statistics and accessibility, and collects "mouse movements, scroll position, keypress events, touch events". We look at the gaps in more depth in hCaptcha GDPR concerns.

Verdict: a processor with a DPA and a transfer basis, but it sets a cookie and processing can take place in the US.

Cloudflare Turnstile

Cloudflare's Turnstile privacy addendum lists the signals it processes (IP address, TLS fingerprint, User-Agent and sitekey) and says Cloudflare is a processor for bot detection but a controller, on legitimate interests, when it uses them to improve detection. Its launch post says Turnstile never uses cookies to collect or store information. Cloudflare relies on the Data Privacy Framework and SCCs.

Verdict: passes the cookie test, but your privacy notice should record that Cloudflare is a controller when it uses the signals to improve detection.

Friendly Captcha

Friendly Captcha is a German company. Its end-user privacy policy says it uses no HTTP cookies and hashes the IP address before storing it, and its terms make it a processor under a DPA. Its EU endpoint guide says the default endpoint is global and may serve a request from outside the EU, and that the Germany-hosted endpoint needs the Advanced plan (€200 a month) or Enterprise.

Verdict: strong on every test once you pay for the EU endpoint.

ALTCHA

The ALTCHA widget is MIT-licensed and "sets no cookies, does no fingerprinting, and shares no data with third parties". When you host it yourself, there is no third party to sign a DPA with. ALTCHA Cloud is EU-only.

Verdict: the simplest position on paper, because nothing leaves your servers, but you run the infrastructure.

MTCaptcha

MTCaptcha sets functional cookies, says they are not used to profile visitors across sites, anonymises IP addresses, and is certified under the EU-US, UK and Swiss-US Data Privacy Frameworks. We could not find where data is processed on its own pages.

Verdict: a reasonable position on cookies and transfers, but ask where your visitors' data is processed before you sign.

captcha.eu

captcha.eu is hosted in Austria and says no cookies are set. Its end-user privacy information says the last digits of the IP address are removed before storage, data is kept for up to six months, and the legal basis is legitimate interest. The same page mentions writing a cookie or local storage value, which does not match the homepage.

Verdict: data is processed in a single EU country, but ask which of its two statements on device storage is current.

Prosopo Procaptcha

Procaptcha is cookieless by default and builds no cross-site profile of human visitors. It stores the IP address as the only personal data, on the legitimate-interest grounds of fraud prevention and security. Prosopo is a UK company acting as a processor under a published Data Processing Agreement that lists our subprocessors. Processing runs across points of presence in the US, LATAM, APAC and the EU, and can be restricted to the EU on the Enterprise and Custom plans. Every block comes with a readable reason, which matters for Article 22 GDPR when an automated decision affects a person.

Verdict: passes the cookie test on every plan. If you need EU-only processing, that is an Enterprise feature, not a Free or Professional one.

Choosing a GDPR-friendly CAPTCHA

• Nothing may leave your own servers: self-hosted ALTCHA, or Cap, another open-source proof-of-work widget.
• You want a German or Austrian vendor: Friendly Captcha on the Advanced plan, or captcha.eu.
• You want a managed, cookieless CAPTCHA with a free tier and a reason for every block: Procaptcha.
• You are on WordPress: see how to choose a GDPR-friendly CAPTCHA for WordPress.
• You are replacing reCAPTCHA for cost as well as privacy: see reCAPTCHA alternatives.

Whichever you choose, list it in your privacy notice and record of processing, with its legal basis and the vendor as a processor.