reCAPTCHA Update: Changes to Data Processing and Terms of Service in 2026
Users of Google’s reCAPTCHA service will see significant changes in how their data is processed starting April 2, 2026. Google is transitioning reCAPTCHA from a “data controller” to a “data processor,” shifting responsibility for data control to website owners who deploy the service. This change aligns reCAPTCHA’s data handling with other Google Cloud services and introduces a modern pricing structure.
What is Changing?
Currently, Google acts as the data controller for information collected through reCAPTCHA. However, after April 2, 2026, website owners implementing reCAPTCHA will become the data controllers, determining the purpose and methods of processing user data. Google will then function as a data processor, handling data according to the instructions of its customers. This shift necessitates updates to the Google Cloud Platform Service Specific Terms governing reCAPTCHA use.
As a result of this change, users accessing websites protected by reCAPTCHA will no longer be subject to Google’s Privacy Policy and Terms of Use. These references will be removed from the reCAPTCHA badge displayed on customer websites. Data processing will instead adhere to Google’s Cloud Data Processing Addendum [1].
What Do Website Owners Need to Do?
Website owners currently displaying links to Google’s Privacy Policy and Terms of Use in connection with reCAPTCHA must remove these references from their sites. All Google reCAPTCHA keys must be migrated to a Google Cloud project by the end of 2025 [3]. This migration is necessary for Google to implement a consistent pricing structure and enforce new pricing tiers.
Impact of the Changes: Pricing and Assessments
The transition to a Google Cloud project-based system also introduces changes to reCAPTCHA’s pricing. Previously, some users had access to unlimited v2/v3 reCAPTCHA assessments. After the migration, all users will be subject to the reCAPTCHA free tier, which allows for 10,000 assessments. Any assessments exceeding this quota will result in errors [3]. Migrating to the new system will not require changes to website code.
Benefits of the Update
Google highlights several benefits of these changes, including increased customer control over personal data, purpose-driven processing aligned with individual business needs, and enhanced security features. The unified terms and pricing structure aim to streamline the reCAPTCHA experience for all users.
What is reCAPTCHA?
reCAPTCHA is a free service designed to protect websites from spam, and abuse. It utilizes advanced risk analysis techniques to differentiate between human users and automated bots [1]. ReCAPTCHA v3, in particular, assesses traffic without requiring user interaction, providing a score that website owners can use to determine appropriate actions.