Google reCAPTCHA runs in the background collecting IP addresses, device fingerprints, and behavioral data, then sends it to Google’s servers, which is exactly what has made privacy-conscious site owners look for alternatives. For a contractor’s contact form, a hidden honeypot field, a server-side timing check, or a dedicated service like Cloudflare Turnstile can block the same spam without routing visitor data through a third party first. None of this requires ripping out an existing form, most changes are a plugin setting or a few lines of server code.
Why reCAPTCHA draws privacy scrutiny in the first place
Both reCAPTCHA v2 and v3 work by scoring a visitor’s mouse movement, typing rhythm, IP address, and browser fingerprint against Google’s own model of what a human looks like online, and that scoring happens on Google’s servers rather than the site’s own infrastructure. In the EU, an Austrian federal administrative court ruled in September 2024 that reCAPTCHA is not a technically necessary part of a website and therefore cannot rely on legitimate interest as a legal basis, requiring prior opt-in consent instead. No comparable US court decision or FTC enforcement action naming reCAPTCHA specifically has been published, so the clearest domestic hook is the general CCPA and CPRA framework for California residents rather than a settled legal precedent. Under CPRA, sending a visitor’s IP address and behavioral signals to a third party for its own model training or ad-related purposes can qualify as sharing personal information, though whether a given reCAPTCHA implementation crosses that line depends on configuration and has not been tested in a published case.
Who actually has to worry about this
Most local contractor and home services businesses fall well under CCPA’s thresholds: 25 million dollars or more in annual gross revenue, buying or selling personal information of 100,000 or more California consumers a year, or deriving half of annual revenue from selling personal information. A five-person plumbing company running a standard contact form almost never meets any of these. That does not make the underlying question irrelevant, since general FTC guidance on data practices and a customer’s own expectations about where their information goes still apply regardless of company size, and switching away from a script that quietly reports behavioral data to a third party is a low-effort way to keep the form’s data flow simple and easy to explain if a customer ever asks.
Honeypot fields and timing checks as the free first step
A honeypot is a form field that stays invisible to a real visitor, hidden through CSS or placed off-screen, but still present in the page’s HTML. Automated spam scripts typically fill in every field they can find without distinguishing between visible and hidden ones, so a submission that fills the honeypot gets silently discarded on the server before it ever reaches an inbox. Pairing that with a minimum-time check, rejecting any submission that arrives less than a few seconds after the page loaded, catches scripts fast enough to skip the honeypot but too fast to be a real person filling in three fields. Together these two checks handle the bulk of generic form spam without collecting a single extra data point from the visitor and without a third-party script in the mix at all.
Comparing Cloudflare Turnstile, hCaptcha, and Friendly Captcha
When honeypot and timing checks are not enough on their own, usually because a bot has been built specifically to target one form, a dedicated service adds another layer. They differ meaningfully in what they collect and where.
| Option | Cost (as of September 2026) | Data handling | Notable trait |
|---|---|---|---|
| Honeypot / timing check | free, self-built | no extra visitor data collected | stops generic bots, runs on your own server |
| Cloudflare Turnstile | free | US-based provider, EU-US Data Privacy Framework certified | non-interactive check, no puzzle for the visitor |
| hCaptcha | free tier, paid above a high monthly request volume | US-based, processes IP, device, and timestamp data | works much like reCAPTCHA under the hood |
| Friendly Captcha | free below a low request volume, paid plans start in the tens of dollars | Germany-based (Munich) | uses a small computation the browser solves instead of an image puzzle |
Cloudflare Turnstile runs invisibly for most visitors and skips the classic image puzzle entirely, though the underlying check still happens on a US company’s infrastructure, backed by the EU-US Data Privacy Framework rather than a no-data-collection guarantee. hCaptcha functions technically much like reCAPTCHA and processes comparable data, so from a privacy standpoint it is not a meaningfully different choice. Friendly Captcha’s pitch is that it skips behavioral tracking entirely and instead has the visitor’s browser solve a small computational puzzle, a claim made by the vendor itself rather than confirmed by an outside authority, but a reasonable option for a business that wants to minimize what it collects without hosting a fix in-house.
The accessibility angle most sites miss
Visual image-puzzle CAPTCHAs are widely documented by accessibility researchers as a barrier for blind and low-vision users, who cannot complete a “select all the traffic lights” challenge without sighted assistance, and audio alternatives are only a partial fix since they are increasingly solvable by automated systems too. There is no dedicated US federal statute mandating CAPTCHA accessibility the way GDPR-adjacent rules operate in the EU, but a contact form a chunk of visitors cannot complete is a form that quietly loses leads regardless of legal exposure. A non-interactive option like a honeypot, a timing check, or Cloudflare Turnstile sidesteps the issue outright, since none of them ask the visitor to prove anything at all.
How to check whether your site is even using reCAPTCHA
Plenty of business owners have no idea whether their contact form loads reCAPTCHA, since form plugins and website builders often turn it on by default during setup without anyone actively choosing it. A visible reCAPTCHA badge in the corner of the form is one sign, though the invisible v3 version only shows a small disclosure line in the footer instead. The more reliable check is opening the page’s source through the browser’s “view page source” option and searching for “google.com/recaptcha” or “grecaptcha.” If it shows up, most form plugins, including common WordPress contact form tools, list the setting under a spam or security menu, where it can usually be swapped for a different method without rebuilding the form.
Checklist for moving off reCAPTCHA
- Check whether the contact form actually loads reCAPTCHA, many builders enable it by default.
- Add a honeypot field and a server-side timing check first, since that covers most generic spam.
- If targeted spam continues, add Cloudflare Turnstile or Friendly Captcha on top.
- Update the privacy notice near the form if a third-party service is still involved.
- Watch the spam rate for two to four weeks after switching before adding anything else.
What this comes down to
Dropping Google reCAPTCHA does not mean giving up on spam protection, it just means choosing a method that either collects nothing extra from the visitor or keeps the data handling clear with a different provider. A small plumbing or electrical contractor with one contact form usually does fine with the free honeypot and timing combination alone, while a business running several forms with persistent targeted spam is more likely to need a dedicated service like Turnstile or Friendly Captcha on top. Either way, the point is making that choice deliberately instead of leaving whatever a plugin turned on by default. What belongs in the privacy notice near a contact form is covered in the article on does your business website contact form need a privacy notice, and the same third-party disclosure question comes up with embedded fonts, covered in the article on does embedding Google Fonts create a privacy risk. Businesses that would rather not track plugin defaults themselves get this handled as part of Mr.Site’s managed website service, so a new puzzle never gets between a visitor and the message they were trying to send.