Products

AI Adoption & Privacy

AI Workspace
Pricing

Network Security Pricing

Network DDoS Protection
Partners
About Myra
Login
WAAP (Myra App) AI Workspace EU CAPTCHA Partner Portal
Deutsch English Français
Emergency Demo
Products
Application Security DDoS Protection Web Application Firewall CDN Bot Management CAPTCHA Network Security Network DDoS Protection (cloud) Network DDoS Protection (on-prem) Network DDoS Protection (hybrid)

AI Adoption & Privacy

AI Workspace
Pricing

Application Security Pricing

DDoS Protection, WAF, CDN, Bot Management EU CAPTCHA

Network Security Pricing

Network DDoS Protection
Partners
About Myra

Company

About Us Careers News & Insights Events 2026 Press Contact

Why Myra?

References & Case Studies Certifications Migration Integrations GDPR Compliance Digital Sovereignty

Myra Compared

Myra vs. Competitors Cloudflare Alternative Akamai Alternative F5 Alternative
Login WAAP Login AI Workspace Login EU CAPTCHA Partner Portal Deutsch Français
Emergency Demo

Updated 12 October 2026

Cloudflare Turnstile alternative for EU websites

Turnstile is free, works without image puzzles and does not lock you into Cloudflare's other services, and Cloudflare offers a migration path from reCAPTCHA. Cloudflare's own documents raise two questions for EU operators. Cloudflare is an independent controller for part of the data, and according to its compatibility table Turnstile cannot be used with the Regional Services of its Data Localization Suite. Its mobile guide also says Turnstile relies on cookies and local storage to maintain state. None of this makes Turnstile unlawful. It means you need answers to the same questions you would ask any captcha provider.

What Cloudflare says about Turnstile

Topic According to Cloudflare
How it checks a series of small JavaScript challenges, including “proof-of-work”, “proof-of-space” and “probing for web APIs”
Roles processor when protecting your site; “a data controller of Signals that we process to improve Turnstile's bot detection capabilities”, based on its legitimate interests
Signals “such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin”; no retention period stated
Cookies and storage no cookie list for the standard widget; the mobile guide says Turnstile relies on cookies and local storage to maintain state and track visitor behaviour; the cf_clearance cookie only with pre-clearance, which is off by default
Regional processing not compatible with Regional Services of the Data Localization Suite; according to Cloudflare, the Siteverify API cannot be regionalized yet
Transfers Cloudflare, Inc. is listed under the EU-US Data Privacy Framework (status “Active”, re-certification under review on 11 October 2026); standard contractual clauses as a fallback
Advertising “Turnstile never harvests data for ad retargeting”
Free plan up to 20 widgets, unlimited challenges
Invisible mode you must reference the Turnstile Privacy Addendum in your privacy policy
Own description processes “only the data strictly necessary to provide this security function”; “does not access, store, or transmit … form entries”
Accessibility “Turnstile is WCAG 2.2 AA compliant”

Why the controller role matters in the EU

Under Article 5(3) of the ePrivacy Directive and its national versions, such as § 25 TDDDG in Germany, accessing information on the user's device needs consent unless it is strictly necessary for the service the user asked for. The German authorities count reading device properties with JavaScript as access (DSK guidance, para. 24). The French CNIL says a captcha needs consent when it also serves purposes other than securing the site. The German guidance expects third parties to use the information only for the website concerned (para. 95).

Whether improving its own detection counts as such a second purpose is open; as far as we know, no authority has ruled on Turnstile. If you keep Turnstile, document why you think the exemption applies, or ask for consent.

Questions to ask any alternative

Question Why it matters
Does the provider use the data only to protect your site, and does the processing agreement say so? a second purpose can rule out the strictly-necessary exemption
Where is data processed, and can you fix that contractually? transfers outside the EU need a legal basis and belong in your privacy notice
What does the script read from the browser, and does it use cookies, local or session storage? each of these counts as device access
Can the check start only when the visitor uses the form? the German authorities expect access to start when the function is used
Who maintains the WordPress or CMS integration? Cloudflare points to community plugins for WordPress; Contact Form 7 has an official Turnstile integration since version 6.1
Is there an accessibility statement against WCAG 2.2 AA? public bodies and many shops have to meet accessibility rules

Myra EU CAPTCHA

Apply the table to us as well. Myra EU CAPTCHA, from Myra Security GmbH in Munich, gathers browser and device signals as soon as the page loads, behavioural ones like mouse movement included, so German authorities would count it as device access too (DSK guidance, para. 24), even without cookies. By default the check starts on page load; it can be set to start when the visitor uses the form. This page makes no statement on processing locations, so ask us to confirm them in the data processing agreement. Myra has no accessibility conformance statement for the widget yet. We act as a processor under Article 28 GDPR. The German version of this comparison is Cloudflare Turnstile und DSGVO, and the reCAPTCHA background is in reCAPTCHA and GDPR.

Frequently asked questions

Can Turnstile be restricted to EU-only processing?

According to Cloudflare's own compatibility table, Turnstile is not compatible with the Regional Services of the Data Localization Suite, and Cloudflare notes that the Siteverify API cannot be regionalized yet.

Does Turnstile require the Cloudflare CDN?

No. Cloudflare says Turnstile can be used independently without requiring other Cloudflare services. The free plan allows up to 20 widgets with unlimited challenges, according to Cloudflare.

Is Turnstile GDPR compliant?

There is no general answer, and we know of no data protection authority that has assessed Turnstile (as of 11 October 2026). The relevant questions are device access under the ePrivacy rules, Cloudflare's role as controller for the signals it uses to improve detection, and transfers to the US.

Can I switch from reCAPTCHA to Turnstile without code changes?

Cloudflare offers a compatibility mode for sites migrating from reCAPTCHA. According to Cloudflare's documentation it covers reCAPTCHA up to version 2; score-based reCAPTCHA v3 set-ups need more work.

Sources

This guide reflects the providers' public documentation as of October 2026. It is not legal advice. Check the current documents of each provider and ask your own data protection officer.