Embedding hCaptcha in a GDPR-compliant way

hCaptcha (hcaptcha.com, Intuition Machines Inc., USA) is often marketed as a privacy-friendly reCAPTCHA alternative. It sets fewer persistent identifiers, but it still loads external scripts and transmits the IP address to the USA.

hCaptcha is often presented as the more privacy-friendly choice compared to Google reCAPTCHA. That is partly true: hCaptcha finances itself through paid labelling tasks rather than advertising, states that it does not set cookies for advertising purposes and offers an “Enterprise” mode with reduced data processing. But the basic process stays the same: an external script is loaded, and the IP address and technical browser characteristics are transmitted to Intuition Machines in the USA.

For the legal assessment, the decisive question is whether the call is “strictly necessary”. Section 25(2) no. 2 TDDDG permits consent-free access if it is essential for a service expressly requested by the user. Spam protection on a login form that is regularly attacked without a CAPTCHA can fall under this. A CAPTCHA on every contact form “just to be safe” is harder to justify — here conservative supervisory authorities require consent or a milder solution.

Technically, the data transfer can be reduced but not avoided: the widget can be loaded lazily only when the form is focused, so that pure page visitors who do not use the form are not affected. The “invisible” mode does not change the IP transmission. Anyone who wants to do entirely without an external call has to switch to server-side methods or Friendly Captcha with EU hosting.

Is this a risk?

hCaptcha too loads resources from hcaptcha.com when the form is displayed and transmits the IP address to a US provider in the process. Whether this access is “strictly necessary” within the meaning of Section 25(2) TDDDG depends on the individual case: for a login or registration form with a real risk of abuse it is easier to justify than for a simple contact form with little spam.

What you can do

• Check whether a CAPTCHA is needed at all — for small contact forms, honeypot fields, time traps or a server-side spam filter are often enough.
• If hCaptcha is needed: load it only on the pages that actually contain the form, not globally in the footer.
• Load the hCaptcha widget lazily, ideally only after interaction with the form, not on page load.
• Name hCaptcha in the privacy policy with provider, purpose (spam/bot protection), legal basis and US transfer; document the necessity.

Häufige Fragen

Is hCaptcha really more GDPR-compliant than reCAPTCHA?

In part: hCaptcha does not use advertising cookies and offers more data-frugal modes. But the core process — external script, IP transmission to the USA — is comparable. The difference is one of degree rather than principle.

Do I need consent for hCaptcha?

If the use is “strictly necessary” (e.g. login protection with a real attack risk), there is a strong case for embedding without consent under Section 25(2) TDDDG. For simple contact forms, consent or a CAPTCHA-free solution is the safer choice.

Where is the data transferred to?

To Intuition Machines Inc. in the USA. The transfer relies on the EU-US Data Privacy Framework as long as the provider is certified, and it must be stated in the privacy policy.

How do I embed hCaptcha in a data-frugal way?

Load it only on the affected form pages, lazily on form interaction, and make it transparent in the privacy policy. Check beforehand whether a honeypot plus a server-side filter is enough.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.