Embedding Friendly Captcha in a GDPR-compliant way

Friendly Captcha (friendlycaptcha.com, Friendly Captcha GmbH, Germany) does without user puzzles and tracking: instead of interaction, the browser solves a computing task in the background (proof of work). The servers are in the EU.

Friendly Captcha takes a different approach from the classic CAPTCHAs: there is no image puzzle and no behavioural analysis. Instead, when the form loads, the browser receives a cryptographic computing task that it solves in the background. For humans this is invisible; for bot networks, mass submission becomes computationally intensive and therefore expensive. No cookies are set and no user profile is created.

The big advantage for the GDPR is the provider's location and the hosting: Friendly Captcha is a German company, and processing takes place in the EU according to the provider. This removes the third-country problem that reCAPTCHA and hCaptcha bring with them. A data processing agreement is still needed because the IP address is processed during token verification.

One thing to note is the version difference: older integrations (v1) sometimes used different endpoints and retention periods. The v2 integration is designed for EU processing and shorter retention. For an existing integration it is worth looking at the source code to see which script URL and which API endpoint are actually addressed, and comparing this with the current provider documentation.

Is this a risk?

Friendly Captcha is significantly more data-frugal than reCAPTCHA or hCaptcha, but not entirely without data processing: the widget loads a script from the Friendly Captcha CDN and the browser contacts the API to issue and verify the token. The IP address is processed in the process. In version 2, the provider advertises EU data processing; the exact integration (v1 vs. v2, endpoint) should be checked.

What you can do

• Use the current widget version (v2) with the EU endpoint and check the integration against the provider's documentation.
• Load the script only on form pages, ideally lazily on form focus.
• Conclude a data processing agreement (DPA) with Friendly Captcha GmbH.
• Name Friendly Captcha in the privacy policy with purpose (bot protection), legal basis (usually legitimate interest / necessity) and a note about the brief IP processing.

Häufige Fragen

Does Friendly Captcha need a consent banner?

Usually not. Since no cookies are set, processing takes place in the EU and the bot protection is necessary for the form submission requested by the user, the use can usually be based on Section 25(2) TDDDG or Article 6(1)(f) GDPR.

Does Friendly Captcha process personal data?

Yes, briefly the IP address during the issuing and verification of the token. But no persistent identifier is set and no profile is created. A DPA with the provider is required.

Is Friendly Captcha accessible?

Yes. Since there are no visual or audio puzzles, the typical barrier of image CAPTCHAs does not apply. The proof of work runs automatically in the background.

What is the difference between Friendly Captcha v1 and v2?

v2 is designed for EU data processing, shorter retention periods and a revised widget. Existing v1 integrations should be migrated to v2 and the privacy policy adjusted accordingly.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.