This is not legal advice, and we are not your lawyers. It is a summary of what the official sources say, dated so you can check each one, followed by the alternatives and what each one trades away. WebForms appears near the end as one of those alternatives, with its own trade-off stated.
Why reCAPTCHA raises GDPR questions at all
Three separate rules meet in a captcha, and most arguments online blur them together.
- Access to the visitor's device. Article 5(3) of the ePrivacy Directive, implemented in Germany as § 25 TDDDG and in France as Article 82 of the Loi Informatique et Libertés, requires consent before information is stored on, or read from, a visitor's device, unless that is strictly necessary to provide a service the visitor explicitly asked for. It covers information of any kind, not only cookies.
- What the provider does with the data. If a captcha provider uses what it collects only to protect your form, the access can be argued to be strictly necessary. If it also uses the data for its own purposes, that argument gets much weaker and consent is back on the table.
- Where the data goes. A provider outside the EU means an international transfer, which needs a lawful basis under Chapter V of the GDPR.
Note that a consent banner does not really rescue a captcha. If a visitor refuses consent, the captcha cannot run, and either your form stops working for them or you let them through unprotected. Neither is what you installed a captcha for.
What the regulators have actually said
The clearest official statement is in the CNIL's cookie FAQ, in the question on whether consent is needed for anti-robot or captcha systems (the page was last updated on 29 April 2026). The French regulator says consent is not needed when the solution's only purpose is securing the site, or an authentication mechanism, for the benefit of users, and is needed when the reading and writing also serve other purposes that are not strictly necessary. Then it names an example:
« certains fournisseurs de ces systèmes indiquent explicitement réutiliser les données pour leur propre compte (par exemple la solution reCAPTCHA de la société Google) »
In English: some providers of these systems explicitly state that they reuse the data on their own account, for example Google's reCAPTCHA. The CNIL's recommendation follows directly: use alternative solutions, or complementary security measures, that do not require people's consent.
In Germany the test is written into § 25 TDDDG. Storing or reading information on the end user's device is allowed without consent only where it is unbedingt erforderlich, strictly necessary, for the provider of a digital service to deliver a service the user has explicitly asked for. Whether reCAPTCHA passes that test turns on the same question the CNIL asks: what the data is used for.
We have cited only sources we could read in full on 24 October 2026. Summaries of fines and court decisions involving reCAPTCHA circulate widely; we have left out any we could not check against the decision itself.
What changed in April 2026
reCAPTCHA is now part of Google Cloud Fraud Defense, and on 2 April 2026 Google changed its terms. Google's FAQ says that from that date the references to Google's Privacy Policy and Terms of Use are removed from the reCAPTCHA badge "to reflect the customer's role as data controller and Google's role as data processor", and that by becoming a processor Google is "relinquishing its ability to determine the purposes and means of processing" that data. It processes the data under the Google Cloud Terms of Service and the Cloud Data Processing Addendum. The reCAPTCHA cookie, _GRECAPTCHA, stays as it was.
That goes straight at the second question above: a processor acting on your instructions is not reusing the data on its own account, at least on paper. It does not remove the first question, because the cookie and the access to the device are still there, and whether they are strictly necessary is a judgement for you and, in the end, your regulator. The CNIL's FAQ still uses reCAPTCHA as its example of reuse, and we could not find an authority statement that revisits reCAPTCHA in the light of the change. Treat anyone who tells you the question is settled, in either direction, with some suspicion.
International transfers
Google, hCaptcha's operator and Cloudflare are all US companies. Transfers to US organisations certified under the EU-US Data Privacy Framework rely on the adequacy decision the European Commission adopted on 10 July 2023. On 3 September 2025 the EU General Court dismissed an action to annul that decision (Latombe v Commission, T-553/23), and an appeal has been lodged with the Court of Justice (C-703/25 P). So the transfer question has an answer today, and the answer could still change.
The alternatives, and what each one trades
Cloudflare Turnstile
Free, with up to 20 widgets and no cap on challenges, and no image puzzles: the most it asks of a visitor is a checkbox. Cloudflare's privacy addendum says it collects the visitor's IP address, TLS fingerprint, User-Agent and the sitekey and origin, that it acts as a processor for your site, and that it also uses the data as a controller, on legitimate interests, to improve its bot detection. Cloudflare describes the signals as strictly necessary for detecting and blocking bots, and its documentation says Turnstile does not read form entries. Its own use of the data to improve detection is the part to weigh against the CNIL's test.
hCaptcha
Run by Intuition Machines, a US company that presents itself as a processor, says it does not sell or rent end-user data, and relies on the Data Privacy Framework and standard contractual clauses for transfers. Keeping EU data inside the EU is an Enterprise option. There is a free Basic plan; the passive, low-friction modes are paid. It is API-compatible with reCAPTCHA v2, which makes it the smallest code change away from Google.
Friendly Captcha
A German company. Instead of puzzles, the visitor's browser solves a cryptographic proof-of-work in the background while they fill in the form. It says it stores no cookies, trackers or personal data from your visitors, and states WCAG 2.2 AA certification. The free plan is for non-commercial use only (one domain, up to 1,000 requests a month). Commercial plans start at €9 a month for the same limits, then €39 for five domains and 5,000 requests, and €200 for 50 domains and 50,000.
ALTCHA and other self-hosted proof-of-work
ALTCHA is an open-source widget under the MIT licence that you can run entirely on your own infrastructure: your server issues the proof-of-work challenge and verifies the answer, so no third party is involved at all. Its site states no cookies, no fingerprinting and no data shared with third parties. Paid managed and self-hosted tiers exist (from €47 and €99 a month) and add an interactive check for higher-risk visitors.
The trade-off for every proof-of-work option is the same. Each submission costs a little computation, which is nothing for one visitor and real money for a script sending thousands. But it cannot tell a person from a well-resourced bot, it can take noticeably longer on an old phone, and like every captcha it does nothing about spam typed by a human.
No captcha: honeypot plus server-side filtering
The option the CNIL's recommendation points to most directly is not to touch the visitor's device at all. A honeypot is just one more field in your own form. A time trap is a timestamp your own page writes into your own form. Content checks run on your server, on the message the visitor chose to send you. None of it stores anything on the visitor's device or sends anything to a third party before they press submit. It will not stop every bot a captcha would, but for a typical contact form it is the right place to start, and you can still add a captcha to the one form where it turns out not to be enough.
Where WebForms fits
WebForms is a form backend: your HTML form posts to an endpoint, and every submission is stored, spam-filtered and delivered to email, Slack, Discord, Telegram or a webhook. For this question, the relevant facts are these.
- Submissions are stored on servers in Germany, and deleted automatically once they pass the plan's retention period: 30 days on Free, 180 on Pro, 365 on Agency.
- Spam filtering runs on our side, on every plan including Free, without a captcha: a honeypot field, a time trap, disposable-email and content checks, sender reputation and an AI classifier. Your form is your own HTML posting to our endpoint, with no script of ours on the page, so nothing is read from the visitor's device by a captcha provider.
- Suspected spam is quarantined, meaning stored and readable in the dashboard but never delivered, rather than silently deleted.
One trade-off you should know before choosing us for a privacy-sensitive form. The AI classifier reads submission content, and it is run by subprocessors outside the EU: a provider in the United States, with a fallback provider in Singapore, both named on our privacy page and in our DPA and contractually barred from training on what they receive. If no third party should see what your visitors write, switch the classifier off for that form; the rule-based filter then runs alone, and no submission content leaves our infrastructure for spam checking. Our DPA covers the transfers with an adequacy decision or standard contractual clauses.
How to choose
- A contact form, newsletter signup or volunteer form with ordinary traffic: start with no captcha. Honeypot, time trap and server-side filtering, then watch what gets through.
- A form under sustained bot attack: add proof-of-work or Turnstile to that form only. Self-hosted ALTCHA keeps everything on your own server; Friendly Captcha is the hosted option from an EU company; Turnstile is free and the lowest friction, with Cloudflare's own use of the data to weigh.
- Replacing reCAPTCHA v2 with the fewest code changes: hCaptcha, after checking its transfer and processor terms against your own.
- Staying on reCAPTCHA: arguably more defensible since Google became a processor in April 2026, but the device-access question remains and the CNIL's guidance still names it. Either way, say in your privacy notice that you use it; Google requires that if you hide the badge.
Whatever you pick, your privacy notice has to say what the form collects and why. The generator linked below drafts the notice a contact form needs, and tells you when a consent checkbox is actually required.
Sources, checked 24 October 2026
- CNIL, questions-réponses on the cookies and other trackers guidelines, question on anti-robot and captcha systems: cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ
- § 25 TDDDG, German federal law text: gesetze-im-internet.de/ttdsg/__25.html
- Google Cloud Fraud Defense FAQ, on the 2 April 2026 change: docs.cloud.google.com/recaptcha/docs/faq
- Court of Justice of the European Union, press release of 3 September 2025 on Latombe v Commission (T-553/23): curia.europa.eu
- Cloudflare Turnstile plans and privacy addendum: developers.cloudflare.com/turnstile/plans and cloudflare.com/turnstile-privacy-policy
- hCaptcha pricing and GDPR pages: hcaptcha.com/pricing and hcaptcha.com/gdpr
- Friendly Captcha pricing and product claims: friendlycaptcha.com
- ALTCHA: altcha.org and github.com/altcha-org/altcha