Google reCAPTCHA Enterprise: the default, and what Forrester said about it

reCAPTCHA is the product everybody has and almost nobody chose. It arrived with a framework, or a previous developer, or a WordPress plugin. That changes what the evaluation is for: the decision is usually whether to keep something you inherited, rather than a comparison between options you chose.

What reCAPTCHA Enterprise is

Google's paid bot detection service, sold through Google Cloud alongside Google Cloud Fraud Defense. The only public company evaluated in the Q2 2026 Wave.

Where it leads

Accessibility. Google ships dashboards in hundreds of languages, more than any other vendor in the category. And if your organisation already runs on Google Cloud, reCAPTCHA Enterprise is the option that requires no new vendor, no new DPA and no new procurement cycle. That is a real advantage and it is why it keeps winning by default.

Where Forrester identified gaps

These are the harshest findings in the Wave. Forrester's verdict: vision is undifferentiated, the roadmap has catch-up items, AI agent trust management is missing an agent library, and intent analytics break out only the top four AI agents. Separately, Forrester cited lack of detail and limited drill-down for intent and explainability.

The agent library point is the one that will age fastest. If agent traffic on your site is growing and your vendor identifies four of them, the gap widens every quarter.

What it costs

Published, per assessment, with a monthly free allowance. Google cut that free tier sharply in 2025, pushing a large number of teams into an evaluation they had not planned. Our reCAPTCHA pricing calculator will estimate the monthly figure for your assessment volume.

There was also a terms of service change that required migrating classic site keys into Google Cloud, the second common trigger for an evaluation.

Where data is processed

Google Cloud. reCAPTCHA is now a data processor rather than a controller, which changed the GDPR analysis. It does not answer what Google does with verification signals across the rest of its estate. On Prosopo's Enterprise plan processing can be pinned to the EU, and a dedicated database can be arranged so one customer's visitors are never stored alongside another site's.

How a block gets explained

A score between 0.0 and 1.0. Forrester's phrasing is lack of detail and limited drill-down. When a real customer cannot complete a signup, a score of 0.3 tells you the model was unhappy and nothing about why.

Who authors the rules

Google, entirely. You set thresholds against a score.

Which buyers reCAPTCHA Enterprise suits

It is the stronger fit if you are already inside Google Cloud and your volume stays within the free allowance, if accessibility in a long tail of languages is a hard requirement, or if the bot pressure you face is unsophisticated spam that the current setup is handling. A control that is working does not need replacing.

How Prosopo compares

Prosopo is the stronger fit where the following matter.

The assessment pricing no longer works at your volume.

If you need to explain a specific block to a customer, a CFO or a DPO, and a score will not do it. Every Prosopo block comes with a reason you can read.

EU data processing matters to your DPA and Google Cloud does not fit. Processing can be restricted entirely to the EU on our Enterprise plan.

If agent traffic is a live problem and a four-agent breakout is not enough.

Side by side

See also Prosopo vs reCAPTCHA and the Forrester Wave breakdown.