hCaptcha

Overview

hCaptcha is a bot detection and CAPTCHA service used as a privacy-focused alternative to Google reCAPTCHA. It presents challenge puzzles to distinguish human visitors from automated traffic and is commonly deployed on login forms, registration pages, and checkout flows.

What This Script Does

• Loads the hCaptcha challenge widget on pages where bot protection is configured
• Collects browser environment signals (user agent, screen resolution, language, installed plugins) to assess bot probability
• Records interaction data during puzzle solving (mouse movements, timing, touch events)
• Sends collected signals to hCaptcha servers for human/bot classification
• Returns a verification token to the site's backend for server-side validation
• Sets a session cookie (hc_accessibility) for accessibility preferences

Consent & Compliance

• Consent category: Essential
• GDPR/ePrivacy: hCaptcha's data collection is limited to security-related signals necessary for bot detection. Under the ePrivacy Directive, cookies and data processing strictly necessary for a service explicitly requested by the user (e.g., submitting a form) are exempt from consent requirements.
• CCPA: Data collected is used solely for security purposes and is not sold.

Should You Block This Without Consent?

No. hCaptcha is a security service that protects forms and endpoints from automated abuse. Blocking it without consent would leave those endpoints vulnerable to bots, credential stuffing, and spam. It qualifies as a strictly necessary service under ePrivacy and GDPR.