GDPR-first bot protection

CAPTCHA protection with transparent data processing

Stop bots without sending a byte to Google. SilentShield is invisible by default, sets no cookies, stores IP addresses only as hashes and runs on our servers in Germany.

Start free See how it works

No GoogleNo cookiesEU-hostedPseudonymised hashesInvisible to users

GDPR checkPassed

Art. 6(1)(f)GDPR
Art. 28 DPA · includedDPA
EU hostingEU
No cookiesCookie-free

reCAPTCHA → data transfer to the USA

Google · Art. 44 · Cookies

Same form. Zero friction.

With SilentShield

With CAPTCHA

Why reCAPTCHA is a GDPR risk

The most popular CAPTCHA quietly creates legal exposure for EU websites.

Data goes to Google (US)

reCAPTCHA loads Google scripts and shares visitor signals with Google in the US — a transfer EU data authorities have repeatedly flagged.

Cookies & consent

reCAPTCHA typically sets cookies, so you need consent — adding friction and legal overhead to every form.

Puzzles hurt conversions

Image challenges frustrate real users and fail accessibility, costing you sign-ups and sales.

How SilentShield stays GDPR-compliant

Bot protection engineered privacy-first, from the ground up.

No data to Google

SilentShield never contacts Google. No third-party scripts, no ad-network signals — ever.

No tracking cookies

The bot check sets no cookies. Only if a transmission fails does the widget keep the measurements in the tab's session storage until it sends them again.

IP addresses only as hashes

The IP address is used only for the check and is not stored in plain text. What is stored is behaviour measurements, the verdict and the page of the form – with a deletion period per plan.

EU hosting + DPA

The check runs on our servers in Germany, and a Data Processing Agreement (DPA / AVV) is available.

SilentShield vs Google reCAPTCHA

The GDPR dimensions that matter for EU websites.

GDPR dimension	SilentShield	reCAPTCHA
Sends data to Google	No	Yes
Tracking cookies	None	Yes
Data hosting	EU	US (Google)
Sets cookies	No	Usually
Visible puzzles	None by default – an arithmetic task when the result is unclear	Yes
Personal data stored	IP only as a hash; measurements and page with a deletion period	Yes
DPA / AVV available	Yes	Limited

Protect your forms — the GDPR-compliant way

Start for free. No credit card, no cookies, no Google.

Start free

Frequently asked questions

Is there a GDPR-compliant CAPTCHA?

Yes. SilentShield is a GDPR-compliant CAPTCHA: invisible by default, it sets no cookies, stores the IP address only as a hash and keeps data on our servers in Germany — with no transfer to Google.

Is Google reCAPTCHA GDPR-compliant?

reCAPTCHA is widely considered a GDPR risk because it sends personal data to Google in the US and usually requires cookie consent. Several EU data authorities have flagged it.

Does a GDPR-compliant CAPTCHA need a cookie banner?

Not for cookies, if it sets none — SilentShield sets none. Whether the bot check itself needs consent depends on which browser and device characteristics it reads: in Zero-PII mode SilentShield does without fingerprint characteristics (canvas, WebGL, audio). The assessment for your website is up to your data-protection advisor.

Where is my data stored?

On our servers in Germany. The IP address is stored only as a hash, and SilentShield transfers no data to ad networks. We deliver the website and dashboard through Cloudflare.

Do you provide a DPA / AVV?

Yes. A Data Processing Agreement (DPA / AVV) is available for SilentShield customers.

CAPTCHA comparisonCompare the leading CAPTCHA tools side by side.GDPR-compliant reCAPTCHA alternativeSee how SilentShield replaces Google reCAPTCHA — invisible by default and without cookies.hCaptcha alternativeSwitch from hCaptcha to bot protection that is invisible by default, from servers in Germany.Cloudflare Turnstile alternativeA Turnstile alternative that is invisible by default and sets no cookies.Friendly Captcha alternativeBot protection that is invisible by default, from servers in Germany.