GDPR-Compliant CAPTCHA

What is a GDPR compliant CAPTCHA?

A GDPR-compliant CAPTCHA (in German, a DSGVO-konforme CAPTCHA) is a bot-verification widget that meets the EU General Data Protection Regulation's requirements for lawful basis, data minimisation, transparency and cross-border transfer. In practice that means no third-party tracking cookies dropped without consent, no long-lived identifiers used to profile users across sites, no data sold to advertising networks, and a documented lawful basis for the personal data (typically an IP address and a short-lived session ID) that is processed.

Procaptcha is the option EU teams choose to sidestep the compliance traps in Google reCAPTCHA and hCaptcha. It is cookieless by default, does not build a cross-site behavioural profile of human users, offers EU-only processing, and does not require a consent-banner entry under the ePrivacy Directive. It fits inside a GDPR or DSGVO programme without the extensive documentation work reCAPTCHA's US-hosted, cookie-based model requires.

Is Google reCAPTCHA GDPR compliant?

No — not by default. reCAPTCHA drops third-party Google tracking cookies, ties captcha requests to a persistent Google identifier, and processes data in the United States. Using it in the EU generally requires (a) collecting consent for those cookies via a banner, (b) declaring Google as a third-party processor in your privacy notice, and (c) reviewing your data-transfer basis under the Schrems II ruling. hCaptcha has a stricter privacy stance than reCAPTCHA but still sets third-party cookies and processes data in the US by default.

If you need a GDPR-compliant CAPTCHA without any of that overhead, that is the gap Procaptcha was built to fill.

Why GDPR compliance matters for CAPTCHA

Most major CAPTCHA services were built for the US ad-tech market, and the data they collect — long-lived tracking cookies, behavioural fingerprints, cross-site identifiers — does not fit cleanly within European data-protection law. This is not just a UX concern; it is a documented compliance risk that affects your DPA, your record of processing and your privacy notice.

Procaptcha is built differently. It does the same job — telling real users from bots, including the CAPTCHA solver services and CAPTCHA farms that defeat commodity widgets — without the data minefield.

Minimal data by default

Procaptcha is engineered to do the verification job with the smallest possible data footprint:

• No third-party tracking cookies from the widget. Edge-mode deployments may set first-party session cookies for continuity.
• No long-lived advertising identifiers.
• No cross-site behavioural profile of human users. Bot toolkits are catalogued platform-wide so a scraper caught on one customer's site is recognised on another — that's the detection engine, not user tracking.
• No data sold or shared with third parties.

Full details of what's retained and for how long are in our privacy policy.

How it compares to the alternatives

Designed for the rest of your compliance stack

Procaptcha fits alongside the rest of your privacy and compliance work:

• Regional endpoints. EU-only and US-only verification endpoints are available if you need processing to stay in a specific region.
• No consent banner required. Because there is no tracking-cookie scope, you don't need to add Procaptcha to your cookie banner under the ePrivacy Directive.
• Drop-in replacement. The widget integrates the same way as the major incumbents — switch your site key, swap your script tag, done.

Blocks you can read

The compliance question doesn't stop at "did you collect too much data". It also covers: can you explain to a regulator, a customer or your own team why a specific request was blocked? Most enterprise bot-management vendors keep the drill-down inside a fully managed model you can't self-tune, so the honest answer to a regulator becomes "the vendor's algorithm decided".

Prosopo took the other route. The drill-down view Prosopo engineers use internally to build detectors is the same view a customer uses to audit blocks — no vendor-curated intermediate summary between the two. Every verdict comes back with a human-readable reason attached, and every event — request, JA4, timing signal, rule firing — is filterable by every dimension the platform scores on and exportable to Datadog, Splunk, Elastic or Sentinel.

When a legitimate visitor is blocked, the operator can find out why in the same view a Prosopo engineer would. That's the "you will never receive a block you can't explain to your team" commitment, and it's the point of the platform.

Common use cases

• Stop credential stuffing without burying users in tracking.
• Defend signup forms while keeping your privacy notice simple.
• Stop phishing without third-party tracking on your auth flow.

Integration reference

• Get started — site key setup, widget install, and first verification.
• Server-side verification — verify tokens in your backend.
• Framework integrations — React, Vue, Angular, Svelte and more.