“Is there a CAPTCHA that does not use cookies or tracking?”
Is there a CAPTCHA that does not use cookies or tracking?
Short answer
Yes, several vendors say so. ALTCHA's open-source page says no cookies are set, Cloudflare says Turnstile processes only strictly necessary data, and CaptchaKit's privacy policy says no advertising or tracking cookies are used. These are vendor statements, so read each policy against your own setup and ask counsel about consent.
Side by side
What each vendor states about cookies and tracking. Vendor statements, checked October 2026.
| Vendor | Statement | Where |
|---|---|---|
| CaptchaKit | No advertising or tracking cookies; a session cookie for account login; no fingerprinting, tracking pixel, behavioral profiling or cross-site tracking for end users; server logs with IP addresses kept up to 90 days | captchakit.com/privacy |
| ALTCHA | The open-source core sets no cookies and sends no visitor data to third parties | altcha.org/open-source-captcha |
| Cloudflare Turnstile | Processes only the data strictly necessary; does not access form entries | developers.cloudflare.com/turnstile |
| hCaptcha | Lists GDPR, CCPA, LGPD and PIPL compliance; its accessibility mode uses a cookie for hcaptcha.com | hcaptcha.com/pricing and /accessibility |
| Google reCAPTCHA | Sets a necessary _GRECAPTCHA cookie when executed for risk analysis | developers.google.com/recaptcha/docs/faq |
What counts as no cookies
Three different claims get mixed up. A CAPTCHA can set no cookies at all. It can set only a strictly necessary cookie. Or it can set no advertising or tracking cookies while still using a cookie for something else, such as a login session for the account holder. Each claim has different consent consequences, and a regulator reads the facts, not the marketing line.
Even with no cookies, a service still receives a network request, which means an IP address in server logs. So the useful question is not whether the vendor stores nothing. It is what the vendor stores, for how long and for what purpose.
What the vendors state
ALTCHA's open-source page says the core sets no cookies and that visitor data does not leave your server when you self-host it. Cloudflare says Turnstile processes only the data strictly necessary. Google documents the _GRECAPTCHA cookie for reCAPTCHA, and France's CNIL found cookies like it were placed without consent in one case (details).
hCaptcha's pricing page lists several privacy frameworks it complies with, and its accessibility mode uses an encrypted cookie that visitors obtain by email. Friendly Captcha describes privacy-friendly proof of work on its plans page.
What CaptchaKit's policy says
CaptchaKit's privacy policy, last updated May 2026, says a session cookie keeps account holders logged in and that no advertising or tracking cookies are used. For your visitors, it says CaptchaKit receives only the game outcome (pass or fail) and a timestamp, and that there is no fingerprinting, tracking pixel, behavioral profiling or cross-site tracking.
It also says standard server logs, including IP addresses, user agents and request timestamps, are kept for security and abuse prevention for up to 90 days, and that the service is hosted on Vercel with data stored in MongoDB Atlas and payments through Stripe.
What to do next
Pick a candidate, read its policy, then open your site in a clean browser and look at the cookies the widget sets. Write down what you find and show it to counsel with your consent banner. If you are weighing replacements, start with reCAPTCHA alternatives.
How to check any CAPTCHA yourself
Load your form in a clean browser profile with developer tools open. Under Application, Cookies, note every cookie that appears before you interact. Under Network, note which hosts the widget calls. Complete the challenge and look again. Repeat on mobile. Compare the result with the vendor's published statement and keep a dated record.
Do this again after every major vendor update, because widgets change. A statement is a starting point, and your own observation is the evidence.
Why this matters beyond banners
Cookies are only one way a widget can recognize a visitor. Fingerprinting, IP-based profiling and cross-site identifiers do similar work without a cookie, so a no-cookie claim is not the whole picture. CaptchaKit's policy addresses these by name: no fingerprinting, tracking pixel, behavioral profiling or cross-site tracking.
For a fuller read of CaptchaKit's side, see CaptchaKit vs ALTCHA, where the open-source option is compared with the hosted one.
Questions
Does CaptchaKit use cookies?
Its privacy policy says no advertising or tracking cookies are used, and that a session cookie keeps account holders logged in to their dashboard.
Does a no-cookie CAPTCHA avoid the consent banner?
Not automatically. That depends on your law, your setup and what else the widget does. Ask counsel.
Is proof of work always cookie-free?
Vendors such as ALTCHA say so for their core. Check each vendor's statement for the edition you use.
Does CaptchaKit log IP addresses?
Standard server logs including IP addresses are kept for up to 90 days for security and abuse prevention, per the privacy policy.
Is there a CAPTCHA with a visible challenge and no cookies?
CaptchaKit shows a visible game and its policy rules out advertising and tracking cookies.
Where can I compare prices?
See reCAPTCHA alternatives for October 2026 prices.
Sources
- CaptchaKit privacy policy (checked 2026-10-17)
- ALTCHA open-source CAPTCHA (checked 2026-10-17)
- Cloudflare Turnstile docs (checked 2026-10-17)
- hCaptcha pricing (checked 2026-10-17)
- hCaptcha accessibility (checked 2026-10-17)
- Google reCAPTCHA FAQ (checked 2026-10-17)
- Friendly Captcha plans (checked 2026-10-17)
- CNIL deliberation SAN-2023-003 on Legifrance (checked 2026-10-17)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.