Overview
Google reCAPTCHA is a bot detection service that analyses user behaviour to distinguish humans from automated agents. It loads JavaScript from google.com and gstatic.com, sets cookies, and transmits behavioural telemetry to Google's infrastructure. reCAPTCHA v3 operates invisibly, continuously scoring user behaviour without presenting challenges.
Detection capabilities
- Signature count
- 3
- Detection methods
- network
- Property types
- hostnamepathname
Performance impact
Performance Impact
- Script size
- 150 KB
- Requests per page
- 4
Common mistakes
- 1Claiming strictly-necessary legal basis for reCAPTCHA without conducting a DPIA - the EDPB has established that behavioural analysis tools require assessment even when used for security
- 2Loading reCAPTCHA on every page rather than only on forms that need bot protection, increasing unnecessary data transmission to Google
- 3Not recognising that reCAPTCHA v3 runs continuously in the background collecting behavioural data (mouse movements, scrolling, typing patterns) even when the user never sees a challenge
- 4Failing to disclose reCAPTCHA in the privacy policy and cookie declaration because it is considered a security tool rather than tracking
- 5Not considering privacy-preserving alternatives (hCaptcha, Cloudflare Turnstile, server-side rate limiting) that achieve bot protection without transmitting behavioural data to Google
Related services
Scan your site for Google
Run a free ConsentMark scan to see how Google is loading on your site, whether it respects consent, and where governance gaps exist across your wider tag estate.
Start a free scan