Procaptcha: The GDPR-Compliant CAPTCHA Widget

What is Procaptcha?

Procaptcha is Prosopo's CAPTCHA widget — the client-side <script> you drop into any form to replace reCAPTCHA or hCaptcha. It renders on the form, verifies the visitor is human without interrupting the flow for legitimate users, and returns a token your backend verifies against Prosopo's /verify endpoint. Same integration surface as the incumbents; a fundamentally different data-handling posture underneath.

Under the hood Procaptcha runs a layered detection stack — proof-of-work for invisible compute-cost enforcement, behavioural analysis (cursor movement, scroll rhythm, typing cadence), device fingerprinting including JA4 TLS signatures, and network reputation. Real humans pass silently on the strength of those signals; only suspected bots ever see a challenge. When they do, it's a rotating image puzzle or an escalated proof-of-work — configurable per site.

Procaptcha (Widget) vs Prosopo Protect (Site / App)

Procaptcha is the Widget — you drop it on individual forms. Its peer, Prosopo Protect, is the edge-deployed sibling that wraps every request to a site or API. Same detection engine underneath, different install path and scope. Choose Procaptcha when you want per-form verification; choose Protect when you want site-wide or API-wide enforcement.

Is Google reCAPTCHA GDPR compliant?

No — not by default. reCAPTCHA drops third-party Google tracking cookies, ties captcha requests to a persistent Google identifier, and processes data in the United States. Using it in the EU generally requires (a) collecting consent for those cookies via a banner, (b) declaring Google as a third-party processor in your privacy notice, and (c) reviewing your data-transfer basis under the Schrems II ruling. hCaptcha has a stricter privacy stance than reCAPTCHA but still sets third-party cookies and processes data in the US by default.

Procaptcha is the option EU teams choose to sidestep those compliance traps. It is cookieless by default, does not build a cross-site behavioural profile of human users, offers EU-only processing, and does not require a consent-banner entry under the ePrivacy Directive. It fits inside a GDPR or DSGVO (DSGVO-konforme CAPTCHA) programme without the extensive documentation work reCAPTCHA's US-hosted, cookie-based model requires.

Is Google reCAPTCHA GDPR compliant?

No — not by default. reCAPTCHA drops third-party Google tracking cookies, ties captcha requests to a persistent Google identifier, and processes data in the United States. Using it in the EU generally requires (a) collecting consent for those cookies via a banner, (b) declaring Google as a third-party processor in your privacy notice, and (c) reviewing your data-transfer basis under the Schrems II ruling. hCaptcha has a stricter privacy stance than reCAPTCHA but still sets third-party cookies and processes data in the US by default.

If you need a GDPR-compliant CAPTCHA without any of that overhead, that is the gap Procaptcha was built to fill.

Why GDPR compliance matters for CAPTCHA

Most major CAPTCHA services were built for the US ad-tech market, and the data they collect — long-lived tracking cookies, behavioural fingerprints, cross-site identifiers — does not fit cleanly within European data-protection law. This is not just a UX concern; it is a documented compliance risk that affects your DPA, your record of processing and your privacy notice.

Procaptcha is built differently. It does the same job — telling real users from bots, including the CAPTCHA solver services and CAPTCHA farms that defeat commodity widgets — without the data minefield.

Minimal data by default

Procaptcha is engineered to do the verification job with the smallest possible data footprint:

• No third-party tracking cookies from the widget. Edge-mode deployments may set first-party session cookies for continuity.
• No long-lived advertising identifiers.
• No cross-site behavioural profile of human users. Bot toolkits are catalogued platform-wide so a scraper caught on one customer's site is recognised on another — that's the detection engine, not user tracking.
• No data sold or shared with third parties.

Full details of what's retained and for how long are in our privacy policy.

How it compares to the alternatives

Designed for the rest of your compliance stack

Procaptcha fits alongside the rest of your privacy and compliance work:

• Regional endpoints. EU-only and US-only verification endpoints are available if you need processing to stay in a specific region.
• No consent banner required. Because there is no tracking-cookie scope, you don't need to add Procaptcha to your cookie banner under the ePrivacy Directive.
• Drop-in replacement. The widget integrates the same way as the major incumbents — switch your site key, swap your script tag, done.

Blocks you can read

The compliance question doesn't stop at "did you collect too much data". It also covers: can you explain to a regulator, a customer or your own team why a specific request was blocked? Most enterprise bot-management vendors keep the drill-down inside a fully managed model you can't self-tune, so the honest answer to a regulator becomes "the vendor's algorithm decided".

Prosopo took the other route. The drill-down view Prosopo engineers use internally to build detectors is the same view a customer uses to audit blocks — no vendor-curated intermediate summary between the two. Every verdict comes back with a human-readable reason attached, and every event — request, JA4, timing signal, rule firing — is filterable by every dimension the platform scores on and exportable to Datadog, Splunk, Elastic or Sentinel.

When a legitimate visitor is blocked, the operator can find out why in the same view a Prosopo engineer would. That's the "you will never receive a block you can't explain to your team" commitment, and it's the point of the platform.

Common use cases

• Stop credential stuffing without burying users in tracking.
• Defend signup forms while keeping your privacy notice simple.
• Stop phishing without third-party tracking on your auth flow.

Integration reference

• Get started — site key setup, widget install, and first verification.
• Server-side verification — verify tokens in your backend.
• Framework integrations — React, Vue, Angular, Svelte and more.