Products

AI Adoption & Privacy

AI Workspace
Pricing

Network Security Pricing

Network DDoS Protection
Partners
About Myra
Login
WAAP (Myra App) AI Workspace EU CAPTCHA Partner Portal
Deutsch English Français
Emergency Demo
Products
Application Security DDoS Protection Web Application Firewall CDN Bot Management CAPTCHA Network Security Network DDoS Protection (cloud) Network DDoS Protection (on-prem) Network DDoS Protection (hybrid)

AI Adoption & Privacy

AI Workspace
Pricing

Application Security Pricing

DDoS Protection, WAF, CDN, Bot Management EU CAPTCHA

Network Security Pricing

Network DDoS Protection
Partners
About Myra

Company

About Us Careers News & Insights Events 2026 Press Contact

Why Myra?

References & Case Studies Certifications Migration Integrations GDPR Compliance Digital Sovereignty

Myra Compared

Myra vs. Competitors Cloudflare Alternative Akamai Alternative F5 Alternative
Login WAAP Login AI Workspace Login EU CAPTCHA Partner Portal Deutsch Français
Emergency Demo

Updated 12 October 2026

reCAPTCHA and GDPR after Google's role change

You can still use Google reCAPTCHA in the EU, but running it without consent needs a solid argument. The sticking point is less the GDPR than the national rules on access to the user's device, which implement Article 5(3) of the ePrivacy Directive: § 25 TDDDG in Germany, Article 82 of the French Data Protection Act in France. reCAPTCHA sets a cookie and reads information from the browser. The French regulator and an Austrian court found that this was not strictly necessary, in both cases for the period when Google still processed the data as an independent controller. Since 2 April 2026 Google acts as a processor, which helps with the GDPR side but leaves the device-access question open.

Two questions that are easy to mix up

The first concerns the device. Under the German rule, storing information in the browser or reading it needs consent unless it is strictly necessary to provide a service the user has explicitly asked for. The German authorities apply this whether or not the information is personal data (DSK guidance, para. 26), and they count a script that reads device properties and sends them to a server as access (para. 24).

The second concerns what happens to the data at Google: legal basis under Article 6 GDPR, transparency, transfers to the US. Most of the 2026 changes affect this second question.

A processing agreement with Google answers the second question. It does nothing for the first.

What regulators and courts have said

Who When On reCAPTCHA
CNIL (France), cookie FAQ, question 17 as of 29 April 2026 A captcha used only for security needs no consent. One that also serves other purposes does; the CNIL names reCAPTCHA as an example and recommends alternatives that work without consent.
CNIL, sanction SAN-2023-023 29 December 2023 A payment provider used reCAPTCHA on sign-up and login without consent. The operator is responsible too (para. 70). The cookie part of the fine was 15,000 euros and also covered Google Analytics.
Austrian Federal Administrative Court, W298 2274626-1 13 September 2024 reCAPTCHA cookies on a party website were “not necessary for operating a website”; consent would have been required.
Bavarian DPA (BayLDA), FAQ undated Site operators “should definitely look at alternatives” and must be able to demonstrate lawful use. No legal basis is named.
German DPA conference (DSK), guidance on digital services November 2024 Does not mention captchas. Security mechanisms that protect a login can be exempt, but narrowly: only once the function is used and not for other purposes (paras. 74, 83, 95).

The two decisions reason differently. The CNIL pointed to Google using the data for its own analysis; the Austrian court argued more briefly that reCAPTCHA is technically not needed to run a website. Neither binds authorities in other member states.

What changed on 2 April 2026

Google switched reCAPTCHA from controller to processor. According to Google's Cloud FAQ, site operators are now the sole controllers, and Google processes the data under the Cloud Data Processing Addendum. The links to Google's privacy policy and terms disappeared from the badge, and reCAPTCHA is now part of Google Cloud Fraud Defense. Section 45 of the Service Specific Terms says Google processes the information only as needed to provide the service and keep it effective against threats, and not for other purposes such as personalised advertising.

By Google's own terms, the CNIL's main argument from 2023 therefore carries less weight. Several things stay the same for you as the operator:

  1. The _GRECAPTCHA cookie remains unchanged, according to Google. Whether setting it is strictly necessary is a device-access question that no contract settles.
  2. For reCAPTCHA v3, Google recommends running the check on forms and also “in the background of pages for analytics”. For the exemption, the German authorities expect access to start only when the function is actually used (para. 95).
  3. Google now presents you as the sole controller. Your own privacy notice has to carry the full Article 13 information.

We know of no authority or court that has assessed the new arrangement yet (as of October 2026). The CNIL FAQ of 29 April 2026 still names reCAPTCHA as an example without mentioning the switch.

US transfers have a current basis. Google LLC is certified under the EU-US Data Privacy Framework, which the General Court upheld on 3 September 2025 (T-553/23); Google's Cloud DPA provides standard contractual clauses as a fallback. An appeal to the Court of Justice was filed on 31 October 2025 (C-703/25 P) and, to our knowledge, is still pending.

If you keep reCAPTCHA

Load the script only on pages with a form or login, which for v3 goes against Google's recommendation. Decide between consent and the strictly-necessary exemption, and write the reasoning down. Put reCAPTCHA into your privacy notice with purpose, legal basis, recipient and third-country transfer, and remove old links to Google's policy. If you hide the badge, show “This site is protected by reCAPTCHA.” in the flow. Finally, check which Google Cloud project your keys were migrated to and who can access it.

If you switch

The technical switch is manageable because most captchas follow the same pattern: a script in the browser, a token in the form, a check on your server. When you compare providers, ask when the check starts (page load or form use), what the script reads from the browser and whether it sets cookies, whether the provider uses the data only to protect you and says so in the processing agreement, and where the provider is based. Also ask whether visitors have to solve puzzles: for login steps, WCAG 2.2 (success criterion 3.3.8) requires an alternative to cognitive tests such as typing characters or doing sums.

The same test applies to us. Myra EU CAPTCHA, developed and operated by Myra Security GmbH in Munich, collects browser and device characteristics when the page loads, including behavioural signals such as mouse movement, so it is device access under the ePrivacy rules as well, cookies or not. Myra acts as a processor under Article 28 GDPR. A German version of this guide is available: reCAPTCHA und DSGVO.

Frequently asked questions

Is reCAPTCHA banned in the EU?

No. No EU or national law bans it, and we know of no German court decision on it. What the French regulator and an Austrian court objected to was using reCAPTCHA without consent. The Bavarian data protection authority advises site operators to look at alternatives and says you must be able to demonstrate lawful use.

Is reCAPTCHA GDPR compliant since Google became a processor in April 2026?

There is no general answer. Since 2 April 2026 Google describes itself as a data processor for reCAPTCHA and contractually excludes uses such as personalised advertising. The _GRECAPTCHA cookie remains, though, and the rules on access to the user's device do not depend on who the controller is. We know of no authority or court that has assessed the new set-up yet.

Does reCAPTCHA have to go into the cookie banner?

If you rely on consent, yes, and reCAPTCHA should then load only after the visitor agrees. The CNIL points out the catch: a visitor who refuses also bypasses the bot check, so the form needs a second layer. If you want to run it without consent, document why the strictly-necessary exemption applies.

What notice does Google require on the page?

According to Google's FAQ you may hide the reCAPTCHA badge if you show the sentence “This site is protected by reCAPTCHA.” visibly in the user flow. The former links to Google's privacy policy were removed from the badge in April 2026. The information required by Article 13 GDPR belongs in your own privacy notice.

Sources

This guide gives an overview as of October 2026. It is not legal advice. Check the current guidance of your data protection authority or ask your own counsel.