The Cookiepedia is a reference work about 3rd party services that we have evaluated from a privacy perspective. You can use the Cookiepedia in 2 different ways. You can inform yourself out of interest or curiosity. Simply select the appropriate tab and then click on the service you are interested in.

Captcha-Service to distinguish bots from real users

You will first find general information about the service, such as the location of the company behind the service, or also with which legal basis the service can be used.

CAPTCHA
ReCaptcha

Google reCaptcha and DSGVO – a contradiction?

ReCaptcha

Since 2009, the service has been operated by Google LLC. The Captcha service tries to distinguish whether a certain interaction on the Internet is made by a human person or by a computer program or bot.

 Headquarters: Mountain View, California, United States
 Category: Captcha
 Legal Basis: Consent required via Consent Management Platform (CMP)

Then follows information about what function this service performs...

Content of this article
What is ReCaptcha?

Anyone who fills out a contact form on a website often has to prove that she/he is a human being – and not a robot (bot = possible malware) – by using a so-called captcha. These tests can be found in various forms on websites: For example, in a sequence of letters and numbers that is difficult for robots to read, or in the form of a mosaic image (e.g., crosswalks, bicycles or traffic lights).

 

This is certainly familiar to you, or you have encountered it umpteen times on the Internet. Such captchas are not occupational therapy or intelligence tests. No, they have the simple and useful function to protect website operators from a flood of spam by bots. It is supposed to prevent registrations, surveys, comment function etc. on websites from being abused e.g. by fake users, click fraud and DDos attacks etc.. The abbreviation CAPTCHA stands for completely automated public Turing test to tell computers and humans apart. These tests should (one assumes) only be able to be solved by humans.

How does reCaptcha invisible analysis work anyway?

When it comes to Google, data protection experts get curious and take another look. reCaptcha was investigated by data protection experts. According to this investigation, one of the methods for determining humanity is to see if you already have a Google cookie installed in your browser. It is the same cookie that allows you to open new tabs in your browser and not have to log in to your Google account every time.

 

In reCaptcha V3 simulations (the invisible variant), lower risk scores were found with a connected Google account than in browsers without a connected Google account. So if you have a Google account, you are more likely to be human. Moreover, reCaptcha runs with a JavaScript element that examines mouse movements and keyboard strokes, info about the operating system and dwell time, and forwards them to Google.

 

To make the Google tool even better and faster at detecting human behavior on websites, Google wants the reCap

...and why website operators use this service.

In reCaptcha V3 simulations (the invisible variant), lower risk scores were found with a connected Google account than in browsers without a connected Google account. So if you have a Google account, you are more likely to be human. Moreover, reCaptcha runs with a JavaScript element that examines mouse movements and keyboard strokes, info about the operating system and dwell time, and forwards them to Google.

Next, there is an insertion on what to consider legally when using 3rd party services in general.

And then there is the actual evaluation of the service, which becomes interesting especially for the 2nd use case. Here you can find alternatives to the service...

Con

The company behind hCaptcha (Intuition Machines) is based in the USA. Due to the discontinuation of the Privacy Shield, data transfers to the USA are generally not permitted and can only be legitimized within the framework of specific exceptions for individual applications. One possible exception is user consent through a CMP.
A control of the data protection compliant benefits on a technical level is not possible, which is why only the information provided by the company can be relied upon at this point.

...what we would recommend and our conclusion about the service.

Even though any of the above methods or technologies can be considered as a reCaptcha alternative, we recommend Friendly Captcha. 

Was ist das Cookiepedia? (EN)