What does the ALTCHA script do technically?

ALTCHA presents a computational challenge to the visitor's browser when a protected form is encountered. The browser performs cryptographic calculations to solve the challenge, then submits the solution to your server for verification. No cookies are set, no fingerprinting occurs, and no data is sent to third-party services.

How does ConsentStack classify and treat ALTCHA?

ConsentStack identifies ALTCHA as an essential security vendor. Because it sets no cookies and collects no personal data, ConsentStack does not place it behind a consent gate. ALTCHA is allowed to load freely, ensuring your forms remain protected against bot abuse without any consent dependency.

What tracker domains does ALTCHA use?

ConsentStack has catalogued tracker domains for ALTCHA including altcha.org. These are the network destinations ALTCHA's scripts contact, which a consent platform blocks until a visitor agrees.

ALTCHA - Privacy-Friendly CAPTCHA Alternative

Q: Does ALTCHA require cookie consent on my website?

No. ALTCHA is a privacy-by-design bot protection solution. It uses cryptographic proof-of-work challenges that do not set cookies, collect personal data, or communicate with third-party servers. Under GDPR and ePrivacy it qualifies as a strictly necessary security measure exempt from consent requirements.

Back to Vendor Library

Overview

ALTCHA is a privacy-focused, open-source bot protection solution that offers an alternative to traditional CAPTCHA services like reCAPTCHA or hCaptcha. Instead of relying on behavioral tracking, third-party cookies, or image recognition puzzles, ALTCHA uses cryptographic proof-of-work challenges that the visitor's browser solves computationally. This approach verifies human visitors without collecting personal data or depending on external tracking infrastructure.

What This Script Does

ALTCHA's scripts present a computational proof-of-work challenge when a visitor encounters a protected form or action. The visitor's browser performs a series of cryptographic calculations to solve the challenge, and the solution is submitted to the server for verification. This process typically takes a fraction of a second for a human visitor's device but is computationally expensive for bots attempting to submit at scale. The scripts do not set tracking cookies, collect personal data, or make requests to third-party services. All verification can be processed entirely on your own server, keeping the interaction between the visitor's browser and your infrastructure. No fingerprinting, behavioral profiling, or cross-site tracking is involved.

Consent & Compliance

ALTCHA is designed with privacy compliance as a core feature. It does not set cookies, collect personal data, or communicate with third-party servers. The proof-of-work challenge is a purely computational verification that does not involve tracking or profiling visitors. Under GDPR, ePrivacy, and similar frameworks, ALTCHA's scripts qualify as strictly necessary for the security function they provide — protecting forms from automated abuse. The open-source nature of the project allows complete auditability of its privacy claims.

Should You Block This Without Consent?

No. ALTCHA provides essential bot protection functionality without setting cookies or collecting personal data. Its proof-of-work approach is privacy-preserving by design and qualifies as a strictly necessary security measure.

Is ALTCHA GDPR compliant?

ALTCHA's trackers are classified as essential (strictly necessary), so they are generally exempt from prior consent under the GDPR. You should still list them in your cookie policy and privacy notice so visitors know they are there.

Visit website