Yes. Procaptcha processes an IP address and a short-lived session identifier — the minimum needed to verify a request is human — under legitimate interest. The widget is cookieless by default. Human users are not profiled across sites. EU-only verification endpoints are available on request. Prosopo is UK-incorporated and engineered in the UK.
Procaptcha: the GDPR-compliant CAPTCHA widget
Procaptcha is a drop-in CAPTCHA widget that replaces reCAPTCHA or hCaptcha on any form. Real humans pass invisibly on behavioural signals; suspected bots see a challenge. Cookieless by default, no cross-site profiling, EU-only processing available on request.
Why Prosopo
What you get
Drop-in for reCAPTCHA and hCaptcha
The integration surface matches the incumbents. Migration is usually a site-key swap and a script-tag change.
GDPR-compliant, cookieless by default
No third-party tracking cookies. No entry required on your consent banner under the ePrivacy Directive.
EU-only or US-only processing
Pick the region your verification data is processed in. Useful when data residency is part of a compliance sign-off.
Free to 10,000 verifications per month
No card required to start. UK-incorporated, engineered in the UK. Enterprise support goes to the engineers who wrote the detection.
Who Procaptcha is for
Teams migrating off reCAPTCHA or hCaptcha because:
- your DPO flagged the third-party tracking cookies and cross-site behavioural profile,
- EU or UK data-residency is on the roadmap,
- reCAPTCHA v2 or v3 is due to reprice under the new billing model,
- or the current widget is quietly letting scrapers, credential-stuffing tools and disposable-signup bots through.
Where you install it
Anywhere you'd put a CAPTCHA today:
- Login forms — stop credential-stuffing without adding another hop for real users.
- Signup and registration — cut disposable-email and throwaway-account traffic before it hits your database.
- Checkout and payment — block scalper and reseller automation on high-value purchases.
- Contact and support forms — keep spam out without a cookie banner update.
- Comment and review submissions — stop review-farm and forum-spam bots.
How you install it
Two files change on your site: the script tag on the page, and the verify call in your backend.
On the form — drop the script and the widget container:
<script src="https://js.prosopo.io/js/procaptcha.bundle.js" async defer></script>
<form method="POST" action="/login">
<input name="email" type="email">
<input name="password" type="password">
<div data-sitekey="YOUR_SITE_KEY" class="procaptcha"></div>
<button type="submit">Sign in</button>
</form>In the backend — verify the token before you trust the submission:
const res = await fetch("https://api.prosopo.io/siteverify", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ secret: process.env.PROSOPO_SECRET, token }),
});
const { verified, reason } = await res.json();
if (!verified) return reject(reason);The response has the same shape as reCAPTCHA and hCaptcha, so most existing verification code needs a URL change and nothing else. Every verdict comes back with a reason your team can read — a readable reason rather than a numerical score.
How it compares to reCAPTCHA, hCaptcha and Turnstile
Best Partial / caveat Weak
| Capability | Procaptcha | reCAPTCHA | hCaptcha | Cloudflare Turnstile |
|---|---|---|---|---|
| Third-party tracking cookies | ● None | ● Yes | ● Yes | ● None |
| Cross-site behavioural profile | ● None | ● Yes | ● Yes | ● Limited |
| Personal data stored by default | ● IP only | ● Multiple | ● Multiple | ● Minimal |
| Data processed in EU on request | ● | ● Limited | ● Limited | ● Limited |
| GDPR-compliant by default | ● | ● | ● | ● Partial |
| Free tier | ● 10K / month | ● | ● | ● |
| Plain-language reason on every block | ● Technical string | ● Score only | ● Score only | ● Score only |
Procaptcha vs Prosopo Protect
Procaptcha is the widget you drop on individual forms. Prosopo Protect is the edge-deployed sibling that wraps every request to a site or API. Same detection engine, different scope.
| Procaptcha (widget) | Prosopo Protect (site / API) | |
|---|---|---|
| What you install | <script> on the form + /siteverify in your backend | Edge worker (Cloudflare / Lambda@Edge) or reverse proxy (nginx / Caddy) in front of your traffic |
| What it protects | One form at a time | Every request to a site or JSON API |
| When to reach for it | Drop-in reCAPTCHA / hCaptcha replacement on specific forms | Whole-site scraping defence, JSON API abuse, edge access control |
Integration reference
- Get started — site key setup, widget install, first verification.
- Server-side verification — verify tokens in your backend.
- Framework integrations — React, Vue, Angular, Svelte.
- Procaptcha vs reCAPTCHA — side-by-side data controller, pricing and catch-rate comparison.
- Procaptcha vs hCaptcha — how the two compare on GDPR and detection.
Having a problem on a live site? Use Prosopo Support and include the URL where the issue is happening.
Live demo
Try the widget for yourself
Pick a challenge, a theme and a language, then watch the widget rebuild inside a working sign-in form — the same widget your users would see.
Runs right here — no signup, nothing to install.
Live demo
Try Procaptcha
CAPTCHA challenge
How Frictionless works
The default mode. Procaptcha scores the request first, and only asks the visitor to do something when the score is not good enough on its own.
- What the visitor does
- One click, and in the common case nothing after it. The widget is already scoring the request while the page sits open.
- What Procaptcha looks at
- Browser environment characteristics that separate real browsers from headless automation, the shape of natural mouse, touch and keyboard interaction, and the network the request arrives from.
- Where the decision is made
- Server-side, against the Safety Threshold you set in the portal. Tighten it during an attack and loosen it afterwards without touching your integration.
- What happens to a bad score
- The request falls through to a real challenge rather than being blocked outright, so a false positive costs the visitor a few seconds instead of the transaction.
How Proof of Work works
Every client pays a small, unavoidable compute cost before its submission is accepted.
- What the visitor does
- Nothing beyond the click. The puzzle is solved in the background, well inside a second on an ordinary device.
- The puzzle
- The browser searches for an input whose hash begins with a set number of zero bits. Finding a solution takes real work; checking one is instant. That asymmetry is the entire mechanism.
- Why it stops automation
- The cost scales with volume. A visitor solves one puzzle; an operator firing ten thousand requests solves ten thousand. Difficulty is tuned per site, so you choose where that bill starts to bite.
- What it resists
- There is no answer to resell. Unlike an image grid, a solver farm cannot pre-compute or outsource the work — every request needs its own solution, computed at request time.
How Image CAPTCHA works
The familiar grid test, kept for requests that have already failed a quieter check.
- What the visitor does
- Picks the images matching a prompt out of a grid, over two rounds by default.
- How it is marked
- Each round is scored as a proportion of correct selections against a threshold — 0.8 out of the box — rather than demanding a flawless grid.
- What you can tune
- The number of rounds and the pass threshold are both per-site settings, within a house cap on rounds. More rounds costs an attacker more, and costs your visitors more too.
- Where it fits
- Strongest as the thing frictionless mode falls through to. Image challenges are the easiest kind to hand to a solver farm, which is what makes them irritating as a front door without being especially effective there.
How Slider Puzzle works
A drag-to-fit challenge, quicker on a phone than picking images out of a grid.
- What the visitor does
- Drags a puzzle piece across the background image until it sits in the notch it was cut from.
- Decoys
- Further notches are drawn alongside the real one, so the target is a shape to match rather than the only gap on the image.
- How it is marked
- The resting position is checked server-side against a tolerance — around fifteen pixels by default — so a close human drag passes and a miss does not.
- What you can tune
- Tolerance, how many decoys are drawn and the contrast they are drawn at are all per-site settings in the portal.
Theme
Widget mode
Placement
Centred over the page, or anchored to the widget.
32 translations are included with the widget.
How widget mode works
Whether the widget appears on the page at all.
- Checkbox
- The familiar "I am human" box sits in your form. The visitor clicks it, verification runs there and then, and your submit button unlocks.
- Invisible
- Nothing renders. Verification runs when the visitor submits, so the form's own button becomes the trigger and the widget takes up no layout space at all.
- What changes in your code
- One render option — `size: "invisible"` — and a submit handler that calls `procaptcha.execute()` and waits for the callback rather than posting straight away.
- Which to choose
- Invisible suits a form that already has one obvious submit. Checkbox is the safer default when visitors benefit from seeing that a check happened, and it is the only mode where a challenge can be anchored to the widget.
How challenge placement works
Where the challenge opens on the occasions one is needed.
- Popup
- Centred over the page behind a dimmed backdrop. Works wherever the widget sits, including below the fold, and is the default.
- Float
- Anchored to the widget itself, opening beside the checkbox like a dropdown, so the challenge stays in the context of the form being filled in.
- Why Float greys out
- An invisible widget renders nothing for a floating challenge to anchor to, so the bundle resolves that combination back to popup. The control disables Float rather than letting you pick a placement that will not happen.
- What changes in your code
- One render option — `placement` — with no markup or layout changes on your side either way.
Sign in
Checkbox mode: verify with the widget below.
Verified
Your backend would now check this token against /siteverify.
Like what you see? Get a site key free — 10,000 verifications a month, no card required.
How you integrate it
Self-serve setup for a typical stack takes about ten minutes end to end.
2
2. Swap the script tag
Drop the Procaptcha widget in where reCAPTCHA or hCaptcha sits today. React, Vue, Angular and Svelte integrations are in the docs.
3
3. Verify server-side
Verify tokens in the backend against Procaptcha's /verify endpoint. The response shape matches the incumbents, plus a readable reason on every verdict.
By the numbers
Trusted by companies of all sizes.
Active websites
0+
Monthly verifications
0+
Bots stopped per month
0+
Reviews
Our customers love us.
Hundreds of businesses have made the switch from reCAPTCHA and hCaptcha to Prosopo. Here's what they have to say.
Frequently Asked Questions
Is Procaptcha GDPR compliant?
Does Procaptcha need a cookie banner entry?
No. The widget is cookieless by default, so there is no third-party tracking scope to consent to under the ePrivacy Directive.
Can I self-host Procaptcha?
Yes. The base captcha (challenges, collectors, client integration) is open source on GitHub. The advanced behavioural and intent-scoring layers are proprietary; customers who need everything on their own infrastructure receive a periodic obfuscated bundle.
More from Prosopo
What else can Prosopo protect for you?
No matter the threat, we have a solution to keep your business safe.
Product
Accessible CAPTCHA: verification that does not lock people out
An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
Learn more
Product
Residential proxy detection
How Prosopo detects residential proxies — TCP fingerprint interrogation, IP intelligence, and a self-maintained proxy-vendor catalogue. Available on the Enterprise plan.
Learn more
Product
Invisible CAPTCHA
Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot comes with a reason you can read.
Learn more
Product
Procaptcha: the GDPR-compliant CAPTCHA widget
Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 verifications per month.
Learn moreProduct
Access Control — the Customer-Authored Layer
Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
Learn moreProduct
Enterprise Bot Protection — the Prosopo Platform
Enterprise bot protection from Prosopo. One detection engine, delivered as a widget (Procaptcha) or at the edge (Prosopo Protect), same dashboard for both. Every block comes with a reason, in plain words, rather than a black-box score.
Learn moreProduct
Prosopo Protect — Site-Wide and API Bot Protection
Site-wide and API bot protection from Prosopo — deploy at the edge (Cloudflare Workers, AWS Lambda@Edge) or as a server-side integration (nginx, Caddy, custom reverse proxies). Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.
Learn moreProduct
Spam Filter: Add-on for Procaptcha and Prosopo Protect
Spam Filter is a Procaptcha add-on that blocks fake signups, throwaway emails and abusive-network traffic during each verification — without you writing any extra integration code.
Learn more