Best European Alternatives to reCAPTCHA

Why people leave reCAPTCHA

reCAPTCHA is on an enormous share of the web because it was free, it worked, and adding it took one script tag. None of those three is quite true any more, and the first one stopped being true in a way that catches people out.

The legal position is the part that matters most, and it is more specific than the internet suggests. reCAPTCHA is not banned in Europe.

What is at issue is whether it needs consent, and the mechanics point one way: Google’s own documentation says reCAPTCHA sets a cookie, _GRECAPTCHA, when it executes, in order to perform its risk analysis.

Google describes that cookie as necessary and answers its own question “Is reCAPTCHA GDPR Compliant?” with “Yes”. The Austrian Federal Administrative Court took the opposite view in September 2024, holding that reCAPTCHA is not technically necessary for a website to function, so legitimate interest does not cover it.

That produces an awkward result rather than an illegal one. A CAPTCHA that must wait for consent is protecting a form filled in by someone who has not consented to anything yet — and a bot certainly will not click accept. The compliant configuration is the one where the protection is not there when it is needed, which is why organisations look for a mechanism that never needed consent in the first place.

• Consent arrives too late to be useful The Austrian court reasoned that reCAPTCHA offers a security benefit but is not part of a website's basic functionality, so the processing cannot rest on the operator's legitimate interest and requires active, informed opt-in. Apply that honestly and the CAPTCHA loads only after the banner is accepted. Anyone who declines gets an unprotected form, and automated submissions do not interact with banners at all. The fix does not damage the paperwork; it damages the product.
• The vendor says one thing and a court said another Google's reCAPTCHA FAQ states that reCAPTCHA sets a cookie, _GRECAPTCHA, when executed, for the purpose of providing its risk analysis, and calls that cookie necessary. It also answers "Is reCAPTCHA GDPR Compliant?" with "Yes", resting on the commitments in the Cloud Data Processing Addendum. That is the supplier's reading of its own product, which is worth having in writing and is not the same thing as a regulator agreeing. The Austrian Federal Administrative Court reached the opposite conclusion on the necessity question in September 2024, and the gap between those two positions is the risk you are carrying, not a fine somebody has already paid.
• It stopped being a free widget reCAPTCHA now sits inside Google Cloud Fraud Defense with three tiers. Essentials is free up to 10,000 assessments per calendar month but requires a valid billing instrument on the account. Premium is free to the same 10,000, then $8 flat to 100,000 assessments a month, then $1 per 1,000 above that. Enterprise is a fixed monthly commitment at $1 per 1,000 with a twelve-month minimum, and the free allowance is counted per organisation across all accounts and sites rather than per site. The old developer documentation is marked deprecated and points at the Cloud pages.
• Your visitors do the work and someone else keeps it The image challenges are a labelling exercise as well as a test, and the output is useful to the company running them. That is a reasonable trade when the service is free and you chose it. It is a harder conversation when a citizen filling in a council form is asked to identify crossings on behalf of an advertising company before they can report a broken street light, which is the scenario that keeps appearing in public-sector procurement.

What you have to replace, not just match

Be precise about what reCAPTCHA is doing on your site, because the two tools here answer different halves and only one of them is a like-for-like swap.

On most sites it guards form submissions — registration, contact, password reset, checkout — against automated abuse in volume. That is what a proof-of-work challenge replaces well: the visitor's browser does a small computation that costs nothing once and a great deal ten thousand times, with nothing to click and nobody profiled.

What a proof-of-work challenge does not replace is the risk-scoring layer that reCAPTCHA Enterprise sells: account takeover detection, payment fraud signals, per-action scores fed into your own decisions. If you are using that, this page is not offering an equivalent and you should know it before you start rather than after.

The alternatives compared

How each alternative compares to reCAPTCHA

What actually breaks when you switch

Finding every integration takes longer than replacing any of them. Contact forms, registration, password reset, comments, newsletter signups and whatever a plugin wired up years ago each carry their own key and their own verification call. Grep the codebase for the site key before you plan the work, because the count is almost always higher than the one in your head.

Expect your spam numbers to move in both directions for a fortnight. A proof-of-work challenge stops a different population of abuse from an image challenge, so some categories drop to nothing and one or two rise. Keep the old protection running in parallel on a low-value form first, measure for a week, and tune before you touch checkout or password reset.

And write the privacy documentation down as you go. The value of the switch is being able to show what you now do and why no consent is required, which is worth nothing if the cookie policy still describes a Google cookie you no longer set. A migration that fixes the mechanism and leaves the old documentation in place is only half finished, and the half left undone is the half an auditor reads.

Is reCAPTCHA actually illegal in the EU?

No, and it is worth correcting because the claim circulates widely and it is wrong. No European regulator has prohibited reCAPTCHA. What has been decided is narrower and more consequential: that deploying it requires the visitor's consent, because the processing is not strictly necessary to deliver the service the visitor asked for.

The clearest ruling is Austrian: in September 2024 the Federal Administrative Court held that a security benefit does not make a component part of a website's basic functionality, so the processing cannot rest on legitimate interest and consent should have been sought. Google disagrees in its own documentation, which describes the _GRECAPTCHA cookie as necessary and states that reCAPTCHA is GDPR compliant. Both positions are on the record; only one of them is the one your supervisory authority will apply.

So you can keep reCAPTCHA lawfully. You have to put it behind a consent gate, disclose the transfer to Google, and accept that visitors who decline see an unprotected form. Whether that is a compliance solution or a security hole depends entirely on what the form does.

Does proof-of-work actually stop bots?

Neither tool claims to stop abuse outright; both say plainly that what they do is make it expensive. The browser performs a computation that is trivial once and expensive at scale, so a single visitor notices nothing and someone submitting ten thousand forms an hour has to pay for real compute to do it.

That handles the case almost every site actually has: volume spam, credential stuffing at scale, scripted signups. It does not handle a determined attacker with a budget who specifically wants your site, and it does not handle human-operated abuse at all, because a human doing something once is exactly the traffic you are trying to admit.

The practical comparison with reCAPTCHA is closer than it sounds. Image challenges are also defeated by anyone willing to pay a solving service, so what you are choosing between is two ways of making abuse expensive — one of which needs a consent banner and one of which does not.

What does switching involve technically?

Less than the legal discussion that preceded it. Both tools follow the same shape as reCAPTCHA: a widget or script on the page produces a token, your server verifies that token against an endpoint before accepting the submission. The client change is a script tag and a div; the server change is a different verification URL and a different response field to check.

The work that actually takes time is finding every form. Contact pages, registration, password reset, comment boxes, newsletter signups, and whatever a plugin added three years ago all carry their own integration, and on a site of any age the list is longer than anybody expects.

With mCaptcha there is a deployment step on top: you are running the service, so it needs somewhere to live, a certificate, monitoring and updates. That is an afternoon for a team that already runs infrastructure and a genuine obstacle for one that does not.

Is a CAPTCHA the right tool at all?

For a lot of forms, no, and it is worth asking before migrating something you could delete. A honeypot field, a timing check, rate limiting by IP and requiring an email confirmation before anything is published together remove most low-effort spam with no challenge, no third party and no consent question.

A CAPTCHA earns its place where the cost of a successful automated submission is high — account creation, password reset, anything that sends an email on your behalf or costs money — and where rate limiting alone is not enough because the attacker is distributed.

Accessibility belongs in this decision too. Image challenges are genuinely hard for people using screen readers, and the invisible proof-of-work approach both tools here use is markedly better on that count. If you are replacing reCAPTCHA anyway, that is a real improvement rather than a consolation.

Which one to pick

If you run a commercial site and want this dealt with by Friday, Friendly Captcha is the answer: same integration shape, no consent gate, a German company under GDPR and a published price. Budget for a paid plan, because the free tier is for non-commercial sites and discovering that in production is an avoidable annoyance.

If you are a public body, a university or anyone whose complaint is that a visitor should not be talking to a third party at all, mCaptcha is the only option here that actually delivers that, and the fact that you can read the implementation makes it defensible in a way a vendor statement is not. It costs you an operations commitment, and that is the whole price.

If what you actually use is reCAPTCHA Enterprise risk scoring rather than a form challenge, neither of these replaces it, and this page will not pretend otherwise. Keep it, put it behind consent, disclose the transfer properly, and revisit when the fraud signals stop being the reason it is there.