reCAPTCHA and the GDPR: what EU regulators decided

The GDPR is not the only rule in play. The ePrivacy Directive, in its Article 5(3), requires consent before a site stores information on a visitor's device or reads information already there. There is an exception for what is strictly necessary to provide the service the visitor asked for. France applies the rule through Article 82 of its Data Protection Act. The Austrian court read the GDPR together with Article 5(3) itself.

So the question for a CAPTCHA is narrow: is what it reads from the device strictly necessary for the form, or does it also serve another purpose?

On 16 March 2023 the restricted committee of the CNIL, the French data protection authority, adopted deliberation SAN-2023-003 against Cityscoot, a scooter rental company. The total fine was EUR 125,000.

Most of it was not about reCAPTCHA:

• EUR 100,000 for breaches of the GDPR: recording the location of rented scooters far more often than needed, and contracts with processors that lacked required terms.
• EUR 25,000 for breaching Article 82 of the French Data Protection Act by using reCAPTCHA without informing users or asking for their consent.

Cityscoot used reCAPTCHA when people created an account, logged in and reset a forgotten password. The committee accepted that a site can skip consent for device access whose sole purpose is to secure a login. It found that reCAPTCHA does not meet that test, because it also allows analysis by Google. It relied on Google's own terms, which say the reCAPTCHA API works by collecting hardware and software information and sending it to Google for analysis, and which make the site responsible for informing users and asking permission.

It also held that the site, not only Google, was responsible: the site chose to use reCAPTCHA, and so allowed the reading and writing on its users' devices.

In Austria, a visitor complained about a website that loaded reCAPTCHA. On 30 May 2023 the data protection authority, the DSB, found that the processing through reCAPTCHA was unlawful, and the operators of the website appealed.

On 13 September 2024 the Federal Administrative Court (BVwG) dismissed the appeal as unfounded, in case W298 2274626-1. It held that implementing reCAPTCHA was not technically necessary to run the website, that the complainant had never consented to it, and that consent cannot be presumed: it has to come from something the user actively does. The court did not allow a further appeal on points of law.

Neither decision says that bot protection itself needs consent. Both turn on the same two facts: reCAPTCHA reads information from the visitor's device, and it does more with that information than protect the form. Once a check is not strictly necessary, the usual rule applies, and the site needs consent first.

Both are single decisions in two countries. They are not rulings of the Court of Justice of the European Union, and other regulators may weigh other uses differently.

If a check needs consent, a visitor who declines cookies and trackers has declined the check too. A site then has three choices, each with a cost:

• Load it anyway, which is what both decisions found against.
• Load it only after consent, which leaves the form unprotected, or unable to send, for everyone who said no.
• Use a check that does not need the visitor's device information for any purpose beyond protecting the form, and ask counsel whether it falls under the exception.

Questions worth taking to counsel about any form check:

• What does it store on the device, and for how long?
• What does it read from the browser, and who receives it?
• Does the vendor use that information for anything else?
• Where is it processed, and who are the subprocessors?

Challenge is a proof-of-work check: the visitor's browser does a small computation when they press Send. The facts that matter for the questions above:

• It sets no cookies and builds no profile of the visitor.
• It stores nothing in the browser.
• Each check records details of the request, such as the IP address and the user agent, and keeps them only for the site it protects. Nothing links a visitor across sites.
• Botpoison is operated from Belgium, and its data is stored in the EU (Ireland).

The ePrivacy rule covers any storage on the device, and Challenge stores nothing there. What each check records is, again, a question for your counsel, and the GDPR page is there to answer theirs. Challenge starts free; see pricing.

A form check only asks whether a bot is sending. For spam that gets past a bot check, whoever wrote it, Classify reads the message on your server and runs in the EU.

• Deliberation SAN-2023-003 of 16 March 2023 (English translation) CNIL, published by the European Data Protection Board
• BVwG W298 2274626-1, decision of 13 September 2024 Rechtsinformationssystem des Bundes (RIS), Austria