If you run a website in the EU, there is a good chance you are already in breach of the GDPR — without knowing it. The reason is Google reCAPTCHA. It is still the default choice for bot protection, but behind the scenes it transfers user data to the US, collects behavioral data for tracking, requires user consent in many cases, and has been flagged by several EU regulators.
In short: reCAPTCHA is not GDPR-safe by default. That is a problem for anyone whose forms carry the business — SaaS companies, e-commerce stores, lead generation funnels, and government or public sector sites.
Why GDPR and CAPTCHA Clash
The GDPR is built around one core principle: minimize data collection and protect user privacy. Traditional CAPTCHA systems do the opposite. They track users across websites, analyze behavior such as mouse movement and clicks, and send the result to third countries.
That creates several legal risks at once. There is no valid legal basis without explicit consent, the transfer outside the EU runs into the Schrems II ruling, the processing lacks transparency, and fines can follow. What many companies miss is that a bot protection tool is part of their data processing stack like any other processor.
Which Rules Actually Apply
Three parts of the regulation decide whether your CAPTCHA is a problem, and they apply in this order.
Article 6 — is there a legal basis? Loading a third-party script that profiles the visitor is processing. Legitimate interest can carry basic spam defense, but it stops carrying once the tool builds cross-site behavioral profiles. Then you need consent, and consent must come before the script loads — which is the part most implementations get wrong.
Article 28 — who is the processor? Your CAPTCHA vendor processes personal data on your behalf, so you need a data processing agreement with them, and the tool belongs in your record of processing activities. It is a line item there like your mail provider or your analytics.
Articles 44 ff. — where does the data go? Any transfer outside the EU needs a legal mechanism, and after Schrems II a mechanism alone is not enough: you have to assess whether the destination country's surveillance laws undermine it. That assessment is work you do not have to do at all if the data never leaves the EU.
What Makes a CAPTCHA GDPR-Friendly?
Does the CAPTCHA load a third-party script into your page?
- YesConsent needed before it loads
- NoThe request alone needs no consent
Does it store or read cookies or device identifiers?
- YesConsent needed
- NoLegitimate interest can carry it
Before choosing an alternative, it helps to know what "GDPR-friendly" actually means. Five requirements decide it:
- No collection of personal data
- No cross-border data transfer
- No tracking and no fingerprinting
- Works without a consent banner
- Fully transparent processing
Two more separate the merely compliant from the genuinely good: an invisible experience that asks nothing of the visitor, and accessibility that meets WCAG.
How to Check Your Own Site in Ten Minutes
You do not need a lawyer for the first pass. You need the network tab.
- Open a form page and record the network traffic. Any request to
google.com/recaptcha,hcaptcha.comor a similar host tells you a third party sees your visitors. - Check when it fires. If it loads before the visitor accepts anything, consent-based legal grounds are already gone.
- Look for cookies and storage.
_GRECAPTCHAand friends are the visible part; local storage entries count too. - Read your own privacy policy. If the tool is not named there, it is being used without disclosure.
- Check your record of processing activities. Most records list analytics and mail but forget bot protection entirely.
Everything you find here is fixable. What is not fixable is the part you never looked for.
The Alternatives, With What They Actually Cost
Prices below were checked on 3 September 2026 on the vendors' own pages. They change; the sources are linked at each point.
FriendlyCaptcha is a privacy-focused CAPTCHA from Germany. It sets no tracking cookies, states WCAG 2.2 AA and ISO 27001, and its architecture is built around the GDPR. Pricing starts at €9/month for one domain and 1,000 requests, €39/month for five domains and 5,000 requests, €200/month for 50 domains and 50,000. There is a free tier for non-commercial sites up to 1,000 requests. One detail matters for EU buyers: dedicated EU-only data centers appear at the €200 tier, not below it. And the visitor still solves a puzzle, which adds friction to every conversion flow.
Cloudflare Turnstile is free with no published request cap — genuinely free, not a trial. The free tier limits features rather than volume: up to 20 widgets, 10 hostnames per widget, seven days of analytics, no SLA and no per-endpoint policies. It drops Google tracking and keeps interaction minimal. It remains a US-based company, it is not fully invisible in every case, and it says little about how its detection works.
Google reCAPTCHA gives you 10,000 assessments per month free in the Essentials tier. Beyond that, Standard charges a flat $8 up to 100,000 assessments, and above that you move to Enterprise at $0.001 per assessment. The cost is not the problem — the data flow is.
hCaptcha has a permanently free Basic tier. Pro costs $99/month billed annually or $139 month-to-month, includes 100,000 evaluations, and charges $0.99 per additional 1,000. Its privacy positioning is better than Google's, but the visitor still solves image challenges.
SilentShield is invisible, privacy-first bot protection: no user interaction, no tracking, no fingerprinting, no collection of personal data, and no consent banner. The free tier covers 500 requests a month on one domain; Basic is €9/month for 5,000 requests, Pro €29/month for 25,000 requests across five domains, and Enterprise is individual with dedicated EU data centers.
Quick Comparison
| Tool | Entry price | Included | Visitor interaction | Data transfer |
|---|---|---|---|---|
| reCAPTCHA | free | 10,000 assessments | Puzzle | US |
| hCaptcha | free / $99 per month | 100,000 evaluations (Pro) | Puzzle | Mixed |
| Turnstile | free | no published cap | Mostly none | US |
| FriendlyCaptcha | €9 per month | 1,000 requests | Puzzle | EU from €200 tier |
| SilentShield | free / €9 per month | 500 / 5,000 requests | None | EU |
Read the first column honestly: on price alone, Turnstile wins. It is free, it has no volume cap, and for a small site with no compliance requirement that is hard to argue against.
Where SilentShield Is the Weaker Choice
Every comparison where the author wins on every line is worth distrusting, so here are the three lines where we do not.
Our script is bigger than Turnstile's. SilentShield's behaviour module weighs 43.6 KB gzipped, about 47 KB with its loader. On 4 September 2026 we measured in a browser what each vendor actually delivers: Turnstile 27.5 KB, reCAPTCHA 423 KB, hCaptcha 742 KB. Turnstile is the lightest of the four and we are second. We load asynchronously after the page renders, so nothing a visitor waits for is blocked — but if every kilobyte on your page is fought over, that is a real argument against us.
We are not free at volume. Turnstile costs nothing at any volume. Our free tier stops at 500 requests a month. If price is your only criterion, the choice is not us.
We are newer. reCAPTCHA has been running for over a decade and has seen attack patterns we have not. That is not a small thing, and no amount of positioning changes it.
What you get for the €9 is a different trade: nothing loads from a US provider, no cookie is set, no visitor is asked to prove anything, and the assessment stays in the EU. If that is worth more to you than free, we are the better choice. If it is not, take Turnstile — that is a defensible decision and this article is not going to pretend otherwise.
Compliance or Conversion? You No Longer Have to Choose
Most companies treat this as a legal decision. It is not — it is a growth decision. Traditional CAPTCHA kills conversion rates, adds friction, and hurts mobile UX, while a solution that is GDPR-friendly and invisible delivers higher conversions, better UX, and no legal risk.
FriendlyCaptcha solves privacy. Turnstile improves UX, a little. Neither solves both completely. SilentShield does: a privacy-first architecture, verification the visitor never sees, and a product built for modern SaaS and EU businesses.
Upgrade Your Bot Protection (Without Legal Risk)
You do not need to gamble with GDPR compliance, and you do not need to sacrifice conversions.
See how SilentShield works — replace your CAPTCHA in minutes