Procaptcha vs reCAPTCHA 2026: Data Controller, Pricing & Catch Rate

Quick answer: Google reCAPTCHA is still dominant and still free at low volumes, but the April 2024 pricing change dropped the free tier from 1M to 10K assessments per organisation, and the 2026 terms update reclassified Google as a data controller for reCAPTCHA telemetry. Prosopo Procaptcha is EU-hosted, keeps the 10K free tier per site, and stays cheaper than reCAPTCHA Enterprise from around 150K assessments per month upward. Use the reCAPTCHA pricing calculator to model your own volume against both.

Google reCAPTCHA is the default choice on millions of sites because it was free, it worked, and it had Google's brand behind it. In 2026, none of those three things are quite as clean as they used to be. The April 2024 pricing change gutted the free tier, the 2026 terms update reclassified Google as a data controller rather than a processor for reCAPTCHA telemetry, and the traffic-light image challenges haven't kept up with modern stealth browser automation or with the commercial solving services that clear them for fractions of a cent.

We built Procaptcha as an answer to a specific version of that situation — a team that started on reCAPTCHA years ago, isn't unhappy with it, but is now looking at a bill it didn't used to have, a GDPR posture that its data-protection team is asking harder questions about, and a bot problem the traffic-light challenges aren't solving any more. This post is our honest take on where the two products meet, where they diverge, and which of those differences actually change the decision.

Data controller change

The biggest reason teams are re-evaluating reCAPTCHA in 2026 isn't pricing. It's the 2026 terms update that reclassified Google as the data controller for reCAPTCHA telemetry rather than the processor. It sounds like a small distinction. In practice it isn't.

Under the previous model, Google processed reCAPTCHA signals on your behalf and the compliance conversation stayed on your side of the line. Under the new model, Google decides the purpose of processing and your DPIA has to account for Google's own downstream use of those signals — which feed into a broader security and fraud graph that isn't narrowly ring-fenced to your site's verification. EU regulators are increasingly treating that shape of arrangement as requiring explicit consent rather than legitimate interest, which in turn means an extra banner, an extra opt-out path, and an extra thing to explain in the privacy policy.

Procaptcha stays a processor by design. Signal collection is scoped to the verification decision, hosted on EU infrastructure, and doesn't feed a wider data graph. The DPIA fits in a paragraph rather than a working group. If you're not in an EU-facing product this may not be the deciding factor, but for a lot of the teams that speak to us it's the deciding factor.

Free tier: per-organisation vs per-site

The reCAPTCHA free tier looks generous on paper — 10,000 assessments per month at no charge. The catch is that the 10K limit is per Google Cloud organisation, aggregated across every site, key, and account under it. If you run twenty marketing sites and a signup flow, they share one 10K bucket, not twenty. Procaptcha's 10K free tier is per site. Ten forms across five properties gives each of them their own 10K allowance.

Whether that matters depends on how much traffic your organisation is really moving. For a single site under a few thousand assessments a month, both providers are free and nothing changes. For a portfolio of properties or a growing SaaS with more than one product, the per-site model starts to compound.

The honest read on pricing: reCAPTCHA is cheaper than we are up to around 100K assessments per month, at $8 against our $39. Somewhere around 150K assessments the two providers cross over, and by 500K per month we're roughly a quarter of the reCAPTCHA Enterprise cost. If you're sitting inside the free tier, neither product costs you anything. If you're at the crossover, model your own numbers with the reCAPTCHA pricing calculator — we'd rather you make the switch because the maths worked than because of a marketing page.

Catch rate

reCAPTCHA v2's traffic-light image grids were state-of-the-art in 2014. In 2026 they're a well-documented failure mode. Commercial CAPTCHA solving services clear reCAPTCHA v2 puzzles at high accuracy for fractions of a cent per solve, and modern multimodal vision models solve traffic-light and crosswalk grids at near-human accuracy without needing a solving farm at all. The audio fallback is regularly cited in accessibility reviews. That's not a small problem for a product whose main job is to be a barrier.

reCAPTCHA v3 tried to fix this by dropping the visible puzzle and returning an invisible risk score instead. That solved the puzzle-solver problem and created a different one: the risk score is derived from Google's cross-site behavioural graph, which is exactly the data-flow that makes the 2026 controller-model change so awkward. It moved the reCAPTCHA product forward and moved the compliance problem sideways.

Procaptcha's adaptive escalation replaces both the "one visible puzzle for everyone" and the "one opaque risk score for everyone" models with a graded response. The first stage is a passive bot detection check, invisible for legitimate users. Sessions that pass receive an invisible computational proof-of-work token, which stays out of the user's way but adds a non-trivial CPU cost per verification — enough to change the economics of a scraping fleet without changing the experience of a signup form. Sessions that don't pass fall through to an image CAPTCHA puzzle with adaptive difficulty, and repeated suspicious behaviour — rapid requests, automation patterns, shared JA4 fingerprints — earns escalated difficulty rather than another pass. Most legitimate users never see anything visible; the users who do see something are the ones who earned it.

Feature comparison

Beyond the challenge itself

The other place the two products diverge, and where the reCAPTCHA cost picture stops being like-for-like, is in what happens around the verification rather than inside it. We ship a few detection layers that sit outside the challenge; reCAPTCHA v2 and v3 leave those to whoever wires up the surrounding form, and reCAPTCHA Enterprise offers versions of some of them as separately-billed add-ons.

Every form submission runs against a disposable-email database, so an account signing up with mailinator.com, a burner Gmail address with a dot trick, or a fresh 10-minute inbox is caught before the CAPTCHA verdict is even relevant. IP geolocation and impossible-travel checks flag sessions where the claimed location and the actual IP don't add up — a common signal on stolen accounts run through residential proxies. Per-endpoint traffic filtering lets you throttle a login form separately from a marketing signup and block by IP, ASN, geo, JA4 or header hash without needing reCAPTCHA Enterprise plus a separate Google Cloud WAF configuration.

reCAPTCHA v3 does return a risk-signal breakdown that a downstream system could act on, so it isn't fair to say Google knows nothing about these signals. What reCAPTCHA doesn't do is give you a policy layer on top — the signal is there, but turning it into a decision without an Enterprise contract and separate Cloud services is left to you.

Migration

Procaptcha is a drop-in replacement for reCAPTCHA. The widget shape and the server-side verify call are near-identical, so the migration is normally a matter of swapping a script tag, updating the widget div, and pointing the server verify call at our endpoint. Most sites complete the switch in under thirty minutes with no downtime.

- <script src="https://www.google.com/recaptcha/api.js"></script>
+ <script type="module" src="https://js.prosopo.io/js/procaptcha.bundle.js" async defer></script>

- <div class="g-recaptcha" data-sitekey="<recaptcha sitekey>"></div>
+ <div data-sitekey="<procaptcha sitekey>"></div>

The step-by-step guide, including the server-side verify swap, is in How Much Does Prosopo Procaptcha Cost Compared to reCAPTCHA?.

Where the two differ

reCAPTCHA is the right answer for a team running a single low-traffic site inside the 10K free tier, without a GDPR posture requirement, that is comfortable with Google as the data controller for the verification signals and comfortable with the friction cost of traffic-light challenges on legitimate users. That covers a lot of the internet and we don't dispute it.

Procaptcha is the right answer for a team that wants EU-hosted, cookie-free processing with no Google in the controller chain; a per-site free allowance that doesn't aggregate across the organisation; a lower cost per month once assessment volume moves past around 150K; an invisible-by-default UX with real escalation to proof-of-work and image puzzles for the sessions that need it; per-endpoint traffic filtering, disposable-email detection and IP impossible-travel checks bundled with the verification rather than sold through reCAPTCHA Enterprise and separate Cloud services; and a bot-detection stack designed for the way stealth browser automation actually works in 2026.

If you'd like to see the escalation path in action, our live demo runs the same stack we ship to production. If you'd rather model the cost trade-off first, the reCAPTCHA pricing calculator will give you both bills side by side. For the wider context on the 2026 terms change, Google reCAPTCHA is Now a Data Processor and reCAPTCHA is Changing its Terms of Service are worth a read.