Legal
Is reCAPTCHA a privacy problem?
It is a disclosure obligation at minimum. reCAPTCHA transmits visitor data to Google on every page it loads, which makes Google a recipient you must name in your privacy notice — and it means a third party profiles your visitors as the price of a contact form.
What to do instead, in order
- Add a honeypot field — hidden by CSS, rejected if filled. Stops most automated spam.
- Add a submission timing check — reject anything completed in under about three seconds.
- Validate everything again server-side, and rate-limit by IP.
- Measure for two weeks. If spam is controlled, stop here.
- Only then add a challenge, preferring a privacy-respecting option over reCAPTCHA.
Why CAPTCHA is a last resort
It costs every legitimate visitor time, it is a genuine barrier for people with disabilities, and it fails against paid solving services. It should be a response to measured spam rather than a default installed before any spam has arrived.
The accessibility angle
Image and audio challenges exclude people with visual and hearing impairments, and the audio fallback is frequently unusable. A honeypot excludes nobody because no human ever sees it.
The longer version
This answer is deliberately short. If you want the full treatment, Website accessibility, without the compliance theatre covers it in about 5 minutes — free, ungated, written from client work.
Who answered this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan — fifteen live client sites, six of them stores taking real payments. These answers come from those projects rather than from a content brief. More about how I work, or ask me something directly.