reCAPTCHA Update: Changes to Data Processing and Terms of Service

Google’s reCAPTCHA service, a widely used tool for protecting websites from spam and abuse, is undergoing significant changes in how it handles user data. These updates, scheduled to take effect on April 2, 2026, shift Google’s role from a data controller to a data processor, granting website owners greater control over user data collected through reCAPTCHA.

From Data Controller to Data Processor

Currently, Google acts as the data controller for information collected via reCAPTCHA, defining the purpose and means of processing. However, beginning April 2, 2026, website owners deploying reCAPTCHA will become the data controllers. This means they will determine how user data is processed, while Google will function as a data processor, handling the data according to their customers’ instructions. Google Cloud Community

What’s Changing?

To facilitate this transition, Google is updating its Google Cloud Platform Service Specific Terms governing reCAPTCHA usage. Users accessing reCAPTCHA-protected websites will no longer be subject to Google’s Privacy Policy and Terms of Use. Instead, data processing will align with Google’s Cloud Data Processing Addendum. Google Cloud Community

Key Actions for Website Owners

Website owners currently displaying references to Google’s Privacy Policy and Terms of Use in connection with reCAPTCHA should remove these references from their websites. Google Cloud Community

Benefits of the Change

• Customer Control: Website owners will have greater control over how personal data collected through reCAPTCHA is processed.
• Purpose-Driven Processing: Data will be used solely to provide and maintain reCAPTCHA, ensuring its security and effectiveness against evolving threats. Google Cloud Community

Migration to Google Cloud Projects

In addition to the data processing changes, Google is requiring all reCAPTCHA keys to be migrated to a Google Cloud project by the end of 2025. This move aims to unify reCAPTCHA customers under a consistent pricing structure and provide access to advanced security features. Prosopo

Impact on reCAPTCHA Assessments

Website owners migrating to Google Cloud projects will manage their reCAPTCHA keys through the Google Cloud console. The free tier will be limited to 10,000 assessments. Requests exceeding this quota will be rejected. Prosopo

What is reCAPTCHA?

reCAPTCHA is a free service offered by Google designed to protect websites from spam and abuse. It utilizes advanced risk analysis techniques to differentiate between human users and automated bots. Google for Developers reCAPTCHA v3, for example, assigns a score to each request, allowing website owners to determine the appropriate action. Google for Developers

Looking Ahead

These changes to reCAPTCHA represent a broader trend toward greater data privacy and control for website owners. By shifting to a data processor model and integrating with Google Cloud, Google aims to provide a more flexible and secure solution for protecting websites while empowering customers to manage user data in accordance with their own policies.