Privacy-First Architecture
Privacy-first architecture bakes data protection into every layer of a system — minimal collection, strong security and user control by default, not bolted on.
Privacy by Design
Deploy bot protection that respects user privacy
What is Privacy-First Architecture?
Privacy-first architecture means designing a system so that it does not collect what it does not need, rather than collecting broadly and restricting access afterwards. The distinction is where the protection lives: in the design, or in a policy about the data once you hold it.
It is a stronger position than compliance, because data you never collected cannot be breached, subpoenaed, sold after an acquisition, or retained past the point anyone remembers why.
The principles that do the work
Collect for the question you are answering. This sounds obvious and it is where most systems fail, usually because collecting everything is easier than deciding. A bot check needs to answer "is a person present". It does not need to answer "who is this person", and a system that collects enough for the second question has taken on the liability of the second question.
Decide, then discard. Signals that inform a live verdict do not have to be retained afterwards. Most retention exists because deletion was never implemented, not because anyone needed the history.
Process where the user is. Transfers out of the EU need a legal mechanism, and the mechanisms have been through repeated challenge in the courts. Keeping processing local removes the question.
Do not make verification into identification. The moment a check depends on recognising a user across sites, it has become tracking infrastructure with a security purpose attached.
Why CAPTCHAs are a hard case
A CAPTCHA sits on every page that deploys it and sees every visitor. That makes it one of the most privacy-sensitive components a site can install, and the market has largely not treated it that way: several of the most widely deployed CAPTCHAs are operated by advertising businesses, score risk by recognising users across the web, and process in the United States.
The resulting positions are documented rather than theoretical — see our analysis of hCaptcha's GDPR exposure and of what reCAPTCHA collects.
How this is implemented here
Procaptcha is built to the principles above, and the specifics are the part worth checking rather than the label:
- Signals inform a verdict for the session in front of us and are not assembled into a profile of an individual across sites
- No third-party tracking cookies are required for the check to work
- EU processing is available, so the transfer question does not arise
- Verification is distributed across independent provider nodes, so no single operator observes the whole of a site's traffic — see decentralised architecture
What this is not is a claim that no data is processed. Deciding whether a person is present requires observing the session. The claim is narrower and checkable: the minimum needed for that decision, held for as long as the decision takes, in a jurisdiction you choose.