Understanding CAPTCHA, Turing Test

Millions of websites use Google reCAPTCHA to keep bots out of contact forms, login pages, and online accounts. On April 2, 2026, Google changed its legal role in handling reCAPTCHA customer data. The service didn’t stop working, and websites didn’t need to reinstall it. But some of the privacy language businesses have used for years is now outdated.

Google Changed Its Role, Not the Service

Google announced the transition to reCAPTCHA customers before April 2, 2026. Under the revised arrangement, Google processes reCAPTCHA customer data under the Google Cloud Data Processing Addendum and applicable service terms. Google says the change didn't affect reCAPTCHA functionality or require customers to change their implementations.

Google’s reCAPTCHA FAQs explain the distinction. Website operators were already controllers of their visitors’ data. Previously, Google also acted as an independent controller when delivering reCAPTCHA. It now acts as a processor for reCAPTCHA customer data, while the customer is the controller under the service arrangement.

What Changed, What Didn't

• Google removed references to its Privacy Policy and Terms of Use from the reCAPTCHA badge.
• Google recommends removing corresponding reCAPTCHA-specific references from customer websites.
• The _grecaptcha cookie remains in use, and Google reports no change to the service's functionality.

How reCAPTCHA Uses Visitor Data

reCAPTCHA helps websites identify automated activity, spam, fraud, and abuse. It's commonly used on contact forms, account registration pages, login screens, and other interactions that attract bots. Depending on the version and configuration, it evaluates signals associated with a user's interaction and returns an assessment the site can use to decide how to respond.

Google confirms that the _grecaptcha cookie remains after the legal transition. The revised contractual arrangement doesn't mean reCAPTCHA stopped processing visitor information or that every privacy or cookie disclosure can be deleted. Website operators should document the data involved, the purposes for processing it, and any notice or consent requirements that apply to their visitors.

Who’s Responsible for the Data?

Under the European Union's General Data Protection Regulation (GDPR), a controller determines the purposes and means of processing personal data. A processor handles personal data on behalf of a controller. Controllers have obligations that can include identifying a lawful basis, providing privacy information, honoring applicable individual rights, and selecting processors that provide sufficient safeguards.

Google’s new role doesn’t automatically put every website under the GDPR or require a new consent banner. The rules depend on where a business operates, whom it serves, and what information it collects. Businesses subject to the GDPR should check that their records and processor agreements reflect the new arrangement.

Google's Privacy Policy Links and the reCAPTCHA Badge

Google removed references to its Privacy Policy and Terms of Use from the reCAPTCHA badge effective April 2. Its updated guidance recommends that customers remove those references from their own websites when they appear specifically in connection with reCAPTCHA. Links to Google's policies may still be appropriate for other Google services a website uses.

Check contact forms, login pages, website footers, privacy policies, cookie notices, and third-party plugins for older reCAPTCHA wording. Google also says customers may continue to hide the reCAPTCHA badge if needed. Review the developer guidance for the branding rules applicable to the implementation in use.

Google encourages customers to ensure that their end-user disclosures describe reCAPTCHA's purpose: security, fraud, and abuse prevention. Simply deleting the links isn’t enough if visitors still need to be told how their information is used.

Which Privacy Laws Apply?

The United States has no single comprehensive federal consumer privacy law covering all businesses. Sector-specific laws, including the Health Insurance Portability and Accountability Act (HIPAA) and Gramm-Leach-Bliley Act (GLBA), may apply in particular settings. State privacy laws, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), can impose additional duties on covered businesses.

Not every law applies to every business. Coverage depends on factors such as location, industry, the people whose information is collected, and statutory thresholds. Using reCAPTCHA doesn’t automatically trigger a data protection impact assessment or mean a company is violating privacy law. Businesses subject to European or other privacy requirements should check their notices, legal basis, processor terms, and international data transfers where applicable.

Find Where Your Website Uses reCAPTCHA

Start with contact forms, login pages, account registration, checkout pages, and plugins. Check what visitors see, including any Google Privacy Policy or Terms of Use links displayed specifically for reCAPTCHA. Then review the site's privacy notice, cookie disclosures, and vendor records. The checklist below covers what to document.

For background on how these challenges work, see STACK’s article on CAPTCHA. Website forms also deserve attention in a broader incident response plan, especially when they collect personal information.

Why a Contract Change Matters to Your Website

Google changed the legal arrangement behind a service that still looks and works the same. That’s easy to miss. A site can function perfectly while its privacy policy and vendor records describe an arrangement that no longer exists.

Someone needs to read vendor notices and decide whether they require a change. For reCAPTCHA, that might mean updating a privacy notice, saving screenshots of affected forms, and closing a review ticket. It’s a small task compared with the problems an inaccurate disclosure can create.

reCAPTCHA Compliance Review Checklist

If your website uses reCAPTCHA, work through these eight items and keep a record of what you find.

• Inventory: Identify every page and plugin loading reCAPTCHA, including contact, login, registration, and checkout forms.
• Privacy notices: Check for reCAPTCHA-specific links to Google's Privacy Policy or Terms of Use and update outdated language. Describe the site's own security and fraud prevention processing.
• Cookie disclosures: Document whether the _grecaptcha cookie is used and evaluate notice and consent obligations under applicable law.
• Processor terms: Review the Google Cloud Data Processing Addendum and applicable reCAPTCHA service terms. Record the vendor relationship.
• Data mapping: Document data categories, purposes, relevant systems, and any applicable transfer considerations.
• Legal review: Confirm which privacy laws apply before determining whether a lawful basis, assessment, or additional disclosures are required.
• Change evidence: Retain dated screenshots, revised notice text, vendor review records, and change tickets.
• Ongoing ownership: Assign an owner to monitor future Google service and contract notices.

References: Google Cloud reCAPTCHA FAQ and the Google Cloud Data Processing Addendum. This checklist is informational and is not legal advice.

Frequently Asked Questions About reCAPTCHA

For a wider look at how businesses handle sensitive information, read STACK’s cyber insurance coverage guide and phishing overview. The Cyber Liability Insurance Checklist (PDF) is also available if you’re reviewing your organization’s controls and insurance requirements.

If you need help reviewing the security tools on your website or the records behind them, contact STACK Cybersecurity.