GDPR-compliant CAPTCHA: requirements and checklist
Updated:
Quick answer
A CAPTCHA is GDPR-compliant when you have a legal basis for the data it processes, a data processing agreement with the provider, lawful handling of any transfer outside the EU and, where it stores or reads information on the visitor’s device, you meet the ePrivacy rules (in Germany § 25 TDDDG). A cookie-free, EU-hosted service leaves fewer open questions. Confirm your final setup with your data protection officer; this page is not legal advice.
The four questions to answer
- Legal basis. Security measures against abuse are often assessed under legitimate interest (Art. 6(1)(f) GDPR). Document your balancing test.
- Processor agreement. A CAPTCHA provider processes data on your behalf, so Art. 28 GDPR requires a data processing agreement and a list of sub-processors.
- Location and transfers. Processing in the EU avoids the transfer rules in Chapter V GDPR. Transfers to the US need a valid mechanism after the Schrems II judgment.
- Device storage. Storing or reading information on the visitor’s device (cookies, local storage, fingerprinting) needs consent unless strictly necessary (Art. 5(3) ePrivacy Directive, § 25 TDDDG in Germany).
Checklist for your data protection officer
| Check | What good looks like |
|---|---|
| Data processing agreement | Public or sent before signup, with a sub-processor list and change notice |
| Hosting | EU-only, on every plan, with the country stated |
| Cookies and storage | None set by the widget; confirmed in the browser developer tools |
| Data collected | Only what is needed to tell automated from human traffic; no profile of the person |
| Retention | Short and documented |
| Accessibility | WCAG 2.2 AA with a published audit report |
What Burgcaptcha processes and keeps
Burgcaptcha checks the browser, not the person. A proof-of-work task runs in the background and request signals such as headless browsers or known bot networks adjust how hard the task is.
The widget sets no cookies and saves no fingerprint. Hosting is in the EU on every plan and the Transparency section lists the documents for your data protection officer.
Accessibility is part of compliance
Puzzles can lock out people who use screen readers or have motor or cognitive impairments. WCAG 2.2 AA is the common benchmark, and in Germany the Barrierefreiheitsstärkungsgesetz (BFSG), which implements the European Accessibility Act, has applied to many online services since 28 June 2025. Check whether your service falls under it.
Frequently asked questions
Is reCAPTCHA GDPR-compliant?
That depends on your setup. reCAPTCHA is operated by a US provider, so you must assess the legal basis, the processor agreement, transfers outside the EU and any storage on the visitor’s device. Many teams choose an EU-hosted, cookie-free alternative to reduce open questions. Ask your data protection officer.
Do I need a cookie banner for a CAPTCHA?
Only if the CAPTCHA stores or reads information on the visitor’s device in a way that is not strictly necessary. A widget that sets no cookies and stores no identifier usually needs no consent entry. Confirm with your data protection officer.
What does DSGVO-konformes Captcha mean?
It is the German term for a GDPR-compliant CAPTCHA: one that works with a legal basis, a processor agreement, EU hosting and without consent-requiring device storage.
Which law applies in Germany for cookies?
In Germany, § 25 TDDDG implements the ePrivacy rule on storing and reading information on end devices. The GDPR governs the personal data processing that follows.