reCAPTCHA

Overview

Google reCAPTCHA is a bot-detection and CAPTCHA service that protects web forms, login pages, account registration flows, and checkout pages from automated abuse. It is available in three versions: v2 Checkbox, v2 Invisible, and v3 (continuous background scoring). reCAPTCHA Enterprise extends these capabilities for high-assurance environments.

What This Script Does

reCAPTCHA loads JavaScript from www.google.com/recaptcha/ and www.gstatic.com/recaptcha/. The specific behavior depends on the version deployed.

reCAPTCHA v2 Checkbox Presents a visible "I'm not a robot" checkbox. If the browser interaction pattern is insufficient, a visual challenge (image grid selection) is presented. Sets the _GRECAPTCHA cookie (session, essential) to maintain challenge state. Communicates with www.google.com to validate the user's solution.

reCAPTCHA v2 Invisible Runs behavioral analysis silently without showing a checkbox unless a challenge is needed. Same network contacts and cookie behavior as v2 Checkbox, but triggered programmatically on form submission.

reCAPTCHA v3 Executes continuously on every page where it is deployed and scores all user interactions on a 0.0 to 1.0 scale. The score is sent to the server for the application to decide whether to allow, block, or challenge the request. reCAPTCHA v3 sets the _GRECAPTCHA cookie (6 months, first-party) and collects:

• Mouse movements, click patterns, and scroll behavior
• Keystroke timing and cadence (not keystroke content)
• Browser fingerprint: User-Agent, screen dimensions, installed plugins, language settings, timezone
• Device motion and touchscreen signals on mobile
• IP address and approximate geolocation
• Whether the browser is running headless or in a WebDriver context

Data is sent to www.google.com/recaptcha/api2/ and recaptcha.net for scoring. Google's servers return a signed token that the application passes to its backend for server-side verification via www.google.com/recaptcha/api/siteverify.

reCAPTCHA Enterprise Offers the same behavioral analysis as v3, with additional signals including device reputation, account history, and integration with Google's fraud intelligence network. Enterprise scores are assessed via recaptchaenterprise.googleapis.com.

Cookies set:

• _GRECAPTCHA (first-party, session or 6 months depending on version) — maintains challenge state and site identity

Domains contacted: www.google.com, www.gstatic.com, recaptcha.net, recaptchaenterprise.googleapis.com

Consent & Compliance

GDPR/ePrivacy: reCAPTCHA's security purpose makes it a candidate for the "strictly necessary" exemption under ePrivacy. However, the breadth of data collected — behavioral fingerprinting, long-lived cookies, transfer to Google — has drawn regulatory scrutiny. The Austrian DSB and French CNIL have both highlighted that Google reCAPTCHA transfers personal data to Google in the US, requiring a valid transfer mechanism. The German DSK has noted that reCAPTCHA data may be used by Google beyond the immediate security purpose. Operators relying on the strictly necessary exemption should document their assessment in a DPIA.

CCPA/CPRA: Data collected by reCAPTCHA is shared with Google. Google's privacy policy governs subsequent use. While security data collection is a recognized business necessity, operators should disclose this in their privacy policy.

EU-US Data Transfers: Google LLC participates in the EU-US Data Privacy Framework (DPF), providing a transfer mechanism for reCAPTCHA data processed on Google's US infrastructure.

Consent category: Essential (security/bot prevention).

Should You Block This Without Consent?

No. reCAPTCHA serves an essential security function — preventing automated attacks on forms and login pages. Blocking it would leave the site vulnerable to credential stuffing, spam, and bot abuse. Operators should disclose reCAPTCHA in their privacy policy, document the necessity justification in a DPIA, and note that the French CNIL and Austrian DSB have flagged Google data transfers as requiring attention even for security-purpose tools.