“Does reCAPTCHA need cookie consent under GDPR?”

Does reCAPTCHA need cookie consent under GDPR?

Updated October 17, 2026By the CaptchaKit team

Short answer

Regulators have said yes in specific cases. France's CNIL, in deliberation SAN-2023-003 of 16 March 2023, found that reCAPTCHA cookies were placed on a site without information or consent. Google documents a _GRECAPTCHA cookie. This is not legal advice: whether your site needs consent depends on how you configure it and where your visitors live.

What the CNIL decided

The CNIL is France's data protection authority. In deliberation SAN-2023-003, dated 16 March 2023 and published on Legifrance, it looked at a company's use of reCAPTCHA on its website.

Read the original deliberation on Legifrance before you rely on it.

What Google documents

Google's reCAPTCHA FAQ says reCAPTCHA sets a necessary cookie, _GRECAPTCHA, when it executes for risk analysis. Google calls it necessary for the service. A regulator can still read the same facts as requiring consent, which is what the CNIL did in that case. Google's FAQ page is marked deprecated and was last updated on 2026-04-02.

What this means for your site

Three practical consequences follow, and none is legal advice. First, list every cookie your forms set and say who sets it. Second, decide whether your consent banner should hold the CAPTCHA until the visitor agrees, which can break forms for people who decline. Third, record your reasoning, because regulators ask for it.

A CAPTCHA that sets no advertising or tracking cookies makes this analysis simpler, though not automatic. CaptchaKit's privacy policy says no advertising or tracking cookies are used, with a session cookie only for logging in to a CaptchaKit account. It also says the service receives only the pass or fail result and a timestamp from your visitors, and that server logs with IP addresses are kept up to 90 days. Those logs are personal data under many laws, so do not treat any CAPTCHA as a way to avoid disclosure.

Other vendors

Other CAPTCHA vendors publish statements about cookies. ALTCHA's open-source page says its core sets no cookies. Cloudflare says Turnstile processes only the data strictly necessary. hCaptcha's accessibility mode uses an encrypted cookie that visitors obtain by email. Each is the vendor's own statement, so check it against your own setup. Our CAPTCHA without cookies answer lines them up.

A practical review you can do this week

Open your site in a private window, accept nothing on the cookie banner, and look at the cookies and network requests the form page makes. Note whether reCAPTCHA loads before the visitor makes a choice. Do the same on login, registration and checkout. Write the findings down with dates and screenshots.

Then take that file to your counsel with three questions: does the CAPTCHA need consent on our setup, what legal basis do we rely on, and what does the privacy notice say. If your answers change the setup, test the forms again with the banner declined, because holding the CAPTCHA back until consent can leave visitors who decline unable to submit.

What this page is, and is not

This page summarizes a public regulator decision and vendor documents as of October 2026. It is not legal advice and it does not predict how any regulator would treat your site. Laws differ by country and change. We link to primary sources so you can read them yourself.

If you decide to switch

Switching is a normal response to a consent problem, but it is not a fix on its own. The replacement must pass the same review: what does it set, what does it send, and where does the data go. Our CAPTCHA without cookies answer puts vendor statements next to each other, and reCAPTCHA alternatives lists prices.

On WordPress the swap takes about six steps, listed in how to replace reCAPTCHA on WordPress. Update your privacy notice and cookie list at the same time so the documents match what the site does.

Questions

Is reCAPTCHA GDPR compliant?

Compliance depends on your configuration, your consent flow and your legal basis. The CNIL found one site's use non-compliant on cookie consent. Ask counsel about yours.

What cookie does reCAPTCHA set?

Google documents a necessary cookie named _GRECAPTCHA, set when reCAPTCHA executes for risk analysis.

Can I just add reCAPTCHA to my cookie banner?

Many sites do, which can mean the CAPTCHA only loads after consent. That affects forms for visitors who decline. Decide it with counsel.

Does a different CAPTCHA remove the issue?

It changes the facts. Look at what cookies and data the replacement sets, and read its privacy policy. CaptchaKit's policy says no advertising or tracking cookies are used.

Where can I read the CNIL decision?

On Legifrance, as deliberation SAN-2023-003 of 16 March 2023.

Does CaptchaKit log IP addresses?

Its privacy policy says standard server logs, including IP addresses, user agents and request timestamps, are kept for security and abuse prevention for up to 90 days.