Bot403

GDPR and CAPTCHAs

Updated

This is not legal advice. It is a summary of public decisions and guidance, with links to the sources. For a decision about your own site, ask your data protection officer or a lawyer.

The short version

  • In 2024, an Austrian court ruled that a website needed consent for Google reCAPTCHA. The cookie was not technically necessary. The site operator was responsible, although an agency built the site.
  • EU rules on storing and reading data on a device cover more than cookies. They also cover scripts that read browser data and send it back.
  • The French authority CNIL says that a CAPTCHA needs no consent if its only purpose is the security of the site for its visitors. If the data also serves other purposes, the CAPTCHA needs consent. CNIL names reCAPTCHA as an example of this reuse.

Two sets of rules

Article 5(3) of the ePrivacy Directive covers two actions: storing information on the device of a visitor, and reading it back. It applies with or without personal data. These actions need consent, except where the storage or access is strictly necessary for a service that the visitor asked for. Each EU country has its own law for this article, for example § 165 TKG 2021 in Austria and § 25 TDDDG in Germany.

The GDPR covers the personal data that a CAPTCHA processes, for example the IP address. This processing needs a legal basis under Article 6. Transfers outside the EU need their own safeguards.

The Austrian reCAPTCHA ruling (BVwG, 13 September 2024)

The Austrian Federal Administrative Court (Bundesverwaltungsgericht) decided case W298 2274626-1/8E on 13 September 2024. A visitor complained to the Austrian data protection authority (Datenschutzbehörde) about the website of a political party. The visitor used the site to register as a member. The authority found a violation in May 2023. The two founders who operated the site appealed. The court dismissed the appeal.

What the court found and held:

  • The site set the _GRECAPTCHA cookie with a unique random value. It also set the cookie when the visitor clicked "Nicht akzeptieren" (do not accept). Visitors got no information about the cookie.
  • The operators were controllers under Article 4(7) GDPR. They decided on the purposes and means of the processing on their site. The fact that an outside agency built the site did not change this.
  • No valid consent existed. The court referred to Article 5(3) of the ePrivacy Directive and to the Planet49 judgment. It said that consent cannot be presumed and must come from an active step by the visitor.
  • Legitimate interest under Article 6(1)(f) GDPR also did not apply. In the words of the court, reCAPTCHA cookies are not necessary to run a website. The court said that for this reason there is no legitimate interest, even though the operator gets a benefit when the site stops bot input. Also, the operators did not tell visitors which interest they relied on.
  • The court concluded two things: reCAPTCHA was not technically necessary for the website, and thus consent was required.

The decision applies the Austrian Data Protection Act (DSG, § 1) and Article 6 GDPR. It does not apply § 165 TKG 2021. The court did not admit an ordinary appeal (Revision) to the Supreme Administrative Court. It was not possible to confirm whether anyone filed an extraordinary appeal. No later decision on reCAPTCHA was found in the official database (RIS).

Consent must be active: Planet49 (CJEU, 2019)

In Planet49 (C-673/17, 1 October 2019), the Court of Justice of the EU held that a pre-ticked checkbox is not valid consent for storing or reading cookies. The rule applies if the information on the device is personal data, and also if it is not. Visitors must also get information on how long cookies last and whether third parties can read them.

More than cookies: EDPB Guidelines 2/2023

On 7 October 2024, the European Data Protection Board adopted the final version of its Guidelines 2/2023 on the technical scope of Article 5(3). The guidelines say that the rule covers all information, personal data or not. It does not matter which technique stores or reads the information. Cookies are one technique of many. The rule also covers JavaScript that makes the browser send information to a server. It also covers information that the device computes locally and then sends back.

A CAPTCHA script reads browser data, or it computes something on the device. Then it sends the result to a server. Under this interpretation, every CAPTCHA is in the scope of Article 5(3), even a CAPTCHA that sets no cookie. The guidelines do not decide which exemption applies. The next sources discuss that question.

When a CAPTCHA needs no consent: CNIL

CNIL, the French data protection authority, answers this question in its FAQ on cookies and other trackers (question 17, on anti-robot systems and CAPTCHAs):

  • If the only purpose of the CAPTCHA is to secure the site, or a sign-in, for the benefit of its visitors, no consent is needed.
  • If the CAPTCHA also reads or writes data for other purposes that are not strictly necessary, consent is needed. CNIL names Google reCAPTCHA as a service whose provider uses the data for its own purposes.
  • A CAPTCHA that needs consent cannot do its job: a bot can refuse consent and bypass the CAPTCHA. CNIL recommends other solutions, or other security measures that need no consent.

CNIL acted on this point before. In 2020, it required the French health ministry to inform visitors about reCAPTCHA in the StopCovid app and to ask for their consent. The ministry removed reCAPTCHA.

Security exemptions in other guidance

The Article 29 Working Party (the predecessor of the EDPB) wrote about this in Opinion 04/2012 (WP194). It said that "user-centric" security cookies can be exempt, for example a cookie that detects repeated failed sign-ins. A cookie with several purposes is exempt only if every purpose is exempt. The German data protection authorities (DSK) say the same in their guidance for digital services (version 1.2, November 2024). In their view, security that protects the visitor can be strictly necessary under § 25 TDDDG. They also say that a "security" label alone is not enough.

What this means for a form on an EU site

When you read the sources together, they give these questions to ask about each CAPTCHA:

  1. Does it serve one purpose only, the security of your form? Or does the provider also use the data for itself?
  2. What does it store on the device and read from it? What does it send?
  3. Which personal data gets to the provider? How long is this data kept, and does it leave the EU?
  4. Is there a data processing agreement, and does your privacy policy describe the CAPTCHA?

The Austrian case also shows that the responsibility stays with the site operator. It does not matter who built the site.

What Bot403 does

These facts come from the Bot403 privacy page and its browser script. They are input for your own assessment. They are not a conclusion about your site.

  • The script sets no cookie, reads no storage, loads nothing from third parties and does not fingerprint the browser. It makes one request, to the Bot403 challenge endpoint.
  • The browser solves a small proof of work and sends the answer with the form. The token also carries a few yes/no facts about the page view. Two examples are whether navigator.webdriver is set, and whether a key or pointer event happened before the visitor sent the form. The token also carries how long the visitor was on the page. It holds no identifier.
  • Bot403 uses the IP address of the visitor for rate limits. It also uses the address to find out whether the address belongs to a hosting provider. It keeps the address in memory for one minute. It never writes the address to the database or to a log.
  • For each check, Bot403 stores the time, the origin host of the page, the difficulty and the result. It never sees the content of the form.
  • The service runs on one server in Germany. The backups stay in the EU. For the data of your visitors, Bot403 is your processor under a data processing agreement. The data is used only to protect your forms.

If you migrate from reCAPTCHA, read the migration guide. It covers the code, the Content Security Policy and the privacy policy.

Sources

  • BVwG, 13 September 2024, W298 2274626-1/8E, ECLI:AT:BVWG:2024:W298.2274626.1.00: RIS (Austrian legal information system)
  • CJEU, C-673/17 Planet49, 1 October 2019, ECLI:EU:C:2019:801: EUR-Lex
  • EDPB, Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive, version 2.0, 7 October 2024: edpb.europa.eu
  • CNIL, Cookies et autres traceurs, FAQ, question 17: cnil.fr
  • CNIL, deliberation of 10 September 2020 on StopCovid, which reports the formal notice on reCAPTCHA: cnil.fr (PDF)
  • Article 29 Working Party, Opinion 04/2012 on Cookie Consent Exemption (WP194), 7 June 2012: ec.europa.eu (PDF)
  • DSK, Orientierungshilfe für Anbieter:innen von digitalen Diensten, version 1.2, November 2024: datenschutzkonferenz-online.de (PDF)

The sources were examined on 23 October 2026. If a source changed, email [email protected]. Then this page will be corrected.