If you run a website in the EU, your CAPTCHA deserves a close look. Often it is Google reCAPTCHA. It is still the default choice for bot protection, and it loads Google scripts into your page. Since 2 April 2026, Google acts as a processor for it according to its own FAQ (docs.cloud.google.com/recaptcha/docs/faq); whether and how you may use reCAPTCHA is still a matter for legal assessment, and in practice that assessment often turns to consent.
In short: reCAPTCHA should not go into your page unassessed. That matters to anyone whose forms carry the business — SaaS companies, e-commerce stores, lead generation funnels, and government or public sector sites.
Why GDPR and CAPTCHA Clash
The GDPR is built around one core principle: minimize data collection and protect user privacy. Many traditional CAPTCHA systems sit uneasily with that. They load third-party scripts, analyze behavior such as mouse movement and clicks, and often process the result on servers outside the EU.
That raises several questions you need to assess: whether there is a sound legal basis without consent, whether a transfer outside the EU is safeguarded after the Schrems II ruling, and whether the processing is described transparently. What many companies miss is that a bot protection tool is part of their data processing stack like any other processor.
Which Rules Actually Apply
Three parts of the regulation decide whether your CAPTCHA is a problem, and they apply in this order.
Article 6 — is there a legal basis? Loading a third-party script that profiles the visitor is processing. Legitimate interest can carry basic spam defense, but it stops carrying once the tool builds cross-site behavioral profiles. Then you need consent, and consent must come before the script loads — which is the part to watch when you build it in.
Article 28 — who is the processor? Your CAPTCHA vendor processes personal data on your behalf, so you need a data processing agreement with them, and the tool belongs in your record of processing activities. It is a line item there like your mail provider or your analytics.
Articles 44 ff. — where does the data go? Any transfer outside the EU needs a legal mechanism, and after Schrems II a mechanism alone is not enough: you have to assess whether the destination country's surveillance laws undermine it. Much of that assessment falls away when the provider itself is based in the EU and keeps the data there.
What Makes a CAPTCHA GDPR-Friendly?
Does the CAPTCHA load a third-party script into your page?
- YesConsent needed before it loads
- NoThe request alone needs no consent
Does it store or read cookies or device identifiers?
- YesConsent needed
- NoLegitimate interest can carry it
Before choosing an alternative, it helps to know what "GDPR-friendly" actually means. Five requirements decide it:
- As little personal data as possible, nothing stored in plain text
- Data held in the EU
- No tracking cookies and no cross-site profiles
- A legal basis you can document
- Fully transparent processing
Two more separate the merely compliant from the genuinely good: an invisible experience that asks nothing of the visitor, and accessibility that meets WCAG.
How to Check Your Own Site in Ten Minutes
You do not need a lawyer for the first pass. You need the network tab.
- Open a form page and record the network traffic. Any request to
google.com/recaptcha,hcaptcha.comor a similar host tells you a third party sees your visitors. - Check when it fires. If it loads before the visitor accepts anything, consent-based legal grounds are already gone.
- Look for cookies and storage.
_GRECAPTCHAand friends are the visible part;localStorageentries count too. - Read your own privacy policy. If the tool is not named there, it is being used without disclosure.
- Check your record of processing activities. Most records list analytics and mail but forget bot protection entirely.
Everything you find here is fixable. What is not fixable is the part you never looked for.
The Alternatives, With What They Actually Cost
The details below come from the vendors' official pages, retrieved on 4 October 2026. They change; the sources are given at each point.
FriendlyCaptcha is a privacy-focused CAPTCHA from Germany that checks in the background. The Starter plan costs €9/month, Advanced €200/month, and Enterprise is on request. It is free for non-commercial projects (one domain, 1,000 requests a month) and for open-source projects (50 domains, 50,000 requests a month). We could not verify the request limits of the paid plans on the official pricing page — ask the vendor for them. Source: friendlycaptcha.com/free-captcha/.
Cloudflare Turnstile is free with unlimited verifications — genuinely free, not a trial, and your site does not have to run through Cloudflare. The free tier limits features rather than volume: up to 20 widgets, 10 hostnames per widget, seven days of analytics. It loads no Google script and keeps interaction minimal: in Managed mode it shows a checkbox when it sees risk, with no images or text to decipher. Invisible mode requires a notice referencing the "Turnstile Privacy Addendum". Cloudflare remains a US-based company. Source: developers.cloudflare.com/turnstile/plans/.
Google reCAPTCHA (now part of "Google Cloud Fraud Defense") gives you 10,000 assessments per month free in the Essentials tier; you have to add a payment method. In the Premium tier, 10,001 to 100,000 assessments cost a flat $8, then $1 per 1,000; Enterprise sits above that. Visual challenges are available in all tiers. Since 2 April 2026, Google acts as a processor according to its own FAQ. The cost is not the question — the data flow to Google is. Source: docs.cloud.google.com/recaptcha/docs/compare-tiers and /faq.
hCaptcha has a free Basic tier. Pro costs $99/month billed annually or $139 month-to-month, and Enterprise is on request. Passive mode without a visible task is only available in Pro and Enterprise; in the Basic tier a visible check remains. Source: hcaptcha.com/pricing.
SilentShield is privacy-first bot protection that is invisible by default, with data held on our servers in Germany: no user interaction in the normal case (only a short arithmetic task when the result is unclear), no cookies, no cross-site tracking, no profiles, and an optional Zero-PII mode that leaves out browser and device characteristics entirely. The free tier covers 500 requests a month on one domain; Basic is €9/month for 5,000 requests, Pro €29/month for 25,000 requests across five domains, and Enterprise is individual.
Quick Comparison
| Tool | Entry price | Included | Visitor interaction | Data transfer |
|---|---|---|---|---|
| reCAPTCHA | free | 10,000 assessments | Image task possible | |
| hCaptcha | free / $99 per month (annual) | not verified | Puzzle; passive only Pro/Enterprise | not verified |
| Turnstile | free | unlimited verifications | Mostly none; checkbox on risk | Cloudflare (US company) |
| FriendlyCaptcha | €9 per month | not verified | Background check | not verified |
| SilentShield | free / €9 per month | 500 / 5,000 requests | None by default; arithmetic task when unclear | Servers in Germany; no CDN with the EU endpoint |
Read the first column honestly: on price alone, Turnstile wins. It is free, it has no volume cap, and for a small site with no compliance requirement that is hard to argue against.
Where SilentShield Is the Weaker Choice
Every comparison where the author wins on every line is worth distrusting, so here are the three lines where we do not.
Our script is bigger than Turnstile's. SilentShield's behaviour module weighs 45.0 KB compressed, 48.9 KB with its loader (re-measured 23 September 2026). On 4 September 2026 we measured in a browser what each vendor actually delivers: Turnstile 27.5 KB, reCAPTCHA 423 KB, hCaptcha 742 KB. Turnstile is the lightest of the four and we are second. We load asynchronously after the page renders, so nothing a visitor waits for is blocked — but if every kilobyte on your page is fought over, that is a real argument against us.
We are not free at volume. Turnstile costs nothing at any volume. Our free tier stops at 500 requests a month. If price is your only criterion, the choice is not us.
We are newer. reCAPTCHA has been running for over a decade and has seen attack patterns we have not. That is not a small thing, and no amount of positioning changes it.
What you get for the €9 is a different trade: no Google script loads, no cookie is set, the visitor sees no task by default — only a short arithmetic task when the result is unclear — and with the EU endpoint, verification runs directly on our servers in Germany, without a CDN. If that is worth more to you than free, we are the better choice. If it is not, take Turnstile — that is a defensible decision and this article is not going to pretend otherwise.
Compliance or Conversion? You No Longer Have to Choose
Most companies treat this as a legal decision. It is not — it is a growth decision. Traditional CAPTCHA costs conversions, adds friction, and hurts mobile UX, while a privacy-friendly, invisible solution takes that friction out of the form — though it does not do the legal assessment for you.
SilentShield aims at both: no cookies, no cross-site tracking, no profiles; the IP address is used only for the check and not stored in plain text — and a check that stays invisible by default and shows a short arithmetic task only when the result is unclear. Built for modern SaaS and EU businesses.
Upgrade Your Bot Protection — Privacy-Friendly
You do not need to gamble with GDPR compliance, and you do not need to sacrifice conversions.