Why we said goodbye to Google reCAPTCHA

Almost every contact form on the web checks these days whether you are human. Usually through Google reCAPTCHA or Cloudflare Turnstile. Convenient and free, but it also means every visitor who fills in a form shares data with one of the biggest tech companies in the world.

At Devepoling, we stopped doing that.

Why we switched

Form protection should be unobtrusive. What it should not do is piggyback on tracking networks from Google or Cloudflare. For a company that takes privacy and digital sovereignty seriously, that no longer felt right, especially now that good open-source alternatives exist.

That is why the spam check on all the websites we build now runs on Cap, open-source software that we host ourselves on our own servers in the EU.

reCAPTCHA is not exactly harmless

This is not only a matter of principle. reCAPTCHA collects visitors' IP addresses, browser data and behavior, and that data ends up on Google's servers outside Europe. Since the Schrems II ruling by the European Court of Justice, that has been a legal grey area.

Late 2024, the Austrian Federal Administrative Court ruled that using reCAPTCHA without a visitor's explicit consent is unlawful. According to the court, preventing bot traffic does not outweigh the visitor's privacy interest, and reCAPTCHA is not technically necessary for a website to function. The French data protection authority likewise concluded that reCAPTCHA uses data for more than security alone.

For us, that was an extra reason to stop relying on a service where it is unclear exactly what happens with your visitors' data.

How it works, in plain terms

Where reCAPTCHA and Turnstile analyze visitor behavior and device data to decide whether you are human, Cap uses a different principle: a small computational puzzle that the visitor's browser solves within a fraction of a second. People do not notice a thing, and spam bots drop off because the puzzle is just expensive enough to make large scale automation impractical.

No behavioral analysis, no cookies from third parties, no data leaving Europe.

An added bonus: Cap's widget is roughly 12kb minified and brotli'd, about 250 times smaller than hCaptcha, and runs entirely on our own infrastructure without external API calls or quotas.

What this delivers

• No more tracking data flowing to Google or Cloudflare
• Data stays within Europe, on infrastructure we manage ourselves
• Lighter and faster than traditional captchas
• Just as effective against spam bots
• No cookie consent needed for the form itself

Typical of how we build

This switch has little impact for the end user, but it is typical of how we look at software choices: we do not default to the most common solution, we choose privacy and control on purpose, even when that means hosting and maintaining something ourselves. We made the same call before when we chose to self-host Bugsink and Oh Dear instead of relying on external monitoring services.

Working on an existing project and wondering which Google or US services are still baked in? We map that out during a switch to EU services or a code review.

Curious how we would approach this on your project? Get in touch.