10% off every plan until October — because my rent's due.
BasicBS.
Back to blog

Protect EU Customer Data: hCaptcha vs reCAPTCHA for Small Sites

Decorative EU data protection title card

If data minimisation matters to you, hCaptcha wins. It runs cookie-free, blinds IP addresses and offers regional processing, which suits GDPR-sensitive sites. If you run a low-traffic site already tied into Google Analytics and don’t want to touch the code again, reCAPTCHA’s free invisible scoring is still the path of least resistance. The trade-off is simple: privacy control versus convenience that quietly leans on behavioural data.

TL;DR:

  • hCaptcha reduces data exposure with cookie-free deployment, IP blinding, and regional processing, making it more GDPR-friendly for EU-focused sites.
  • reCAPTCHA relies on cookies, behavioral data collection, and Google’s infrastructure, requiring more compliance effort but offering seamless invisible scoring.
  • The free tier of reCAPTCHA covers around 10,000 assessments per month, while hCaptcha’s free plan is comparable until traffic exceeds approximately 150,000 assessments monthly.
  • Transitioning between the two involves simple code changes, but thresholds and scoring logic must be carefully adjusted to maintain accuracy and user experience.
  • For privacy-sensitive sites and regulated sectors, hCaptcha’s certifications and data minimization features make it the safer choice; small-volume sites may prefer reCAPTCHA for ease of integration and cost.
Basic-BS
Build A Clearer, Privacy-Aware Site
BasicBS builds straightforward websites for small businesses, with managed hosting, SSL, SEO and monthly updates included.
Explore BasicBS websites

Table of Contents

hCaptcha vs reCAPTCHA: the quick comparison

Before you dig into the detail, here’s how the two stack up across the dimensions that actually change your decision.

  • Privacy and data flows: hCaptcha offers no-cookie deployment and IP blinding as standard; reCAPTCHA ties into Google’s broader data ecosystem and sets cookies linked to its behavioural analysis.
  • GDPR and compliance controls: hCaptcha publishes a Data Processing Addendum and regional processing options; reCAPTCHA relies on Google’s own DPA and standard contractual clauses, which puts more compliance homework on you.
  • Detection approach and accuracy: reCAPTCHA v3 scores users invisibly from 0.0 to 1.0; hCaptcha mixes challenge puzzles with an Enterprise-only invisible mode called Passive.
  • User experience: reCAPTCHA v3 is frictionless for most visitors; hCaptcha’s free tier still shows image puzzles more often unless you’re on a paid plan.
  • Pricing: reCAPTCHA gives you a free tier of assessments monthly; hCaptcha’s free tier is generous too, but its pricing shifts favourably at higher enterprise volumes.
  • Integration effort: both use similar client-side widgets, but switching between them means inverting your score logic.
  • Global availability: hCaptcha offers regional endpoint options for data residency; reCAPTCHA runs through Google’s global infrastructure.
  • Certifications: hCaptcha lists ISO 27001, ISO 27701, SOC 2 Type II and PCI DSS 4.0 Level 1 among its assurances, alongside Data Privacy Framework enrolment; Google publishes its own certifications under its broader cloud compliance programme.

The certifications point matters more than it sounds. If your business handles EU customer data and needs to show a paper trail during an audit, having a named framework to point to saves you weeks of scrambling later.

What is hCaptcha and how does it work?

hCaptcha built its entire business model around privacy first. Instead of harvesting behavioural data to sell or feed into an advertising ecosystem, it monetises by paying publishers for the labelling work solvers do (the answers you give when sorting images help train machine learning datasets for hCaptcha’s clients). That’s the deal: you solve a puzzle, hCaptcha gets labelled data, and the site owner gets bot protection without becoming a data pipeline for a search giant.

On the free tier, most visitors see the familiar “select all images with a cat” style challenge. Paid tiers change that experience considerably. hCaptcha’s Enterprise plan introduces Passive mode, an invisible verification layer, alongside Private Learning, which trains detection models on pre-blinded data so raw identifiers never leave the blinding layer. hCaptcha explains this mechanism in its own GDPR guidance, which is worth reading if you’re the one signing off on compliance.

Enterprise customers also get Account Defense and broader fraud protection tools, aimed at businesses fighting credential stuffing or fake account creation rather than simple comment-spam bots. If you’re running a shop, a booking system or anything with a login wall, that tier starts to look a lot more relevant than the free widget most small sites bolt on and forget about.

What is hCaptcha and how does it work? — overview diagram

What is reCAPTCHA and how does it work?

reCAPTCHA is the one nearly everyone has clicked at some point, and Google has iterated on it through several distinct versions. v2 is the checkbox and image-grid challenge most people picture when they hear the word “captcha.” v3 ditched the visible challenge entirely in favour of a behavioural score between 0.0 and 1.0, where scores closer to 1.0 signal a likely human. Google also offers Essentials and Enterprise tiers that layer on risk analysis and account defence features aimed at larger operations.

The integration difference matters here. With v2 you’re rendering a widget and checking a pass/fail response. With v3 you’re setting a threshold yourself, deciding whether 0.5 is “let them through” or whether your site needs 0.7 because it handles payments. Get that threshold wrong and you either block genuine customers or let bots stroll straight past.

reCAPTCHA’s free tier covers 10,000 assessments a month, which suits most small business sites comfortably. Beyond that, Enterprise pricing scales with volume and adds features like fraud signals, though Google’s own pricing structure sits closer to the low end for smaller operations compared with hCaptcha’s enterprise tiers.

How do hCaptcha and reCAPTCHA differ on privacy and GDPR?

This is where the two vendors properly diverge, and it’s the section most compliance owners actually came here for.

hCaptcha can run in a Zero PII configuration: no cookies, IP addresses blinded before they’re stored, and the option to route processing through regional endpoints rather than a single global pipeline. Its enterprise features use pre-blinded inputs so machine learning models can be trained without exposing raw identifiers, which is a genuinely clever bit of engineering if data minimisation is a legal requirement rather than a nice-to-have for you.

reCAPTCHA works differently. It collects behavioural telemetry, sets cookies tied to Google’s ecosystem, and that data flows into Google’s infrastructure alongside everything else Google processes. Many supervisory authorities treat embedding a service like this as a data transfer requiring its own lawful basis, documented processing records and a signed DPA, according to reviewer summaries and vendor documentation covering how the two services handle consent obligations differently.

Transfer mechanisms matter too. Google relies on the EU-US Data Privacy Framework and standard contractual clauses for data leaving the EEA. hCaptcha publishes its own Data Privacy Framework enrolment alongside regional processing options, giving you a genuine choice about where data lands rather than a single default route.

Here’s your practical checklist before go-live:

  • Confirm a signed Data Processing Addendum is in place with whichever vendor you choose.
  • Map every cookie the widget sets against your existing cookie policy and consent banner.
  • Document your lawful basis for processing (usually legitimate interest for basic bot protection, but check your specific use case).
  • Update your privacy notice to name the CAPTCHA vendor and describe what it collects.
  • Make sure consent, where required, is captured before the script loads, not after.

Pro Tip: Don’t assume “invisible” means “no data collected.” Invisible scoring models like reCAPTCHA v3 often gather more behavioural signals than a visible puzzle ever needed, precisely because that’s what makes the scoring work.

If your business runs QA processes around test environments, it’s worth applying the same minimisation thinking there too. Guides on test data privacy cover similar pre-blinding and minimisation principles that translate well to CAPTCHA rollout planning.

Which CAPTCHA detects bots more accurately?

Neither vendor will hand you a clean accuracy percentage, and treat anyone who claims one with suspicion. What you can compare is the model.

reCAPTCHA v3 scores behaviour continuously, watching mouse movement, typing rhythm and page interaction to build a probability rather than issuing a binary pass or fail. That’s elegant when it works, but it also means a genuine customer having a bad day on a shaky mobile connection can score low and get flagged unfairly.

hCaptcha’s free tier leans on challenge puzzles, which are blunter but more transparent. Solve it, you’re through. Its Enterprise tier changes the equation with Private Learning, where custom models trained on your own traffic patterns catch threats specific to your platform rather than relying on Google’s generic web-wide dataset. Enterprise customers on both sides also get intent analysis and challenge escalation, meaning suspicious sessions get bumped up to a harder test rather than blocked outright.

None of this defeats the economics of a determined attacker. Independent analyses have found that commercial CAPTCHA farms can solve reCAPTCHA challenges more cheaply per thousand solves than hCaptcha’s, though neither service is impenetrable against a well-funded adversary running residential proxy networks. If you’re defending high-value endpoints, a CAPTCHA is one layer of defence, not the whole wall.

For most small business sites, the practical upshot is this: a slightly higher false-positive rate on a contact form is annoying. The same rate on a checkout page costs you sales. Set your thresholds with that asymmetry in mind.

Which CAPTCHA detects bots more accurately? — overview diagram

Which CAPTCHA gives visitors a better experience?

Visible image challenges cost you conversions, full stop. Every extra click between a visitor and their goal is a chance for them to abandon the page, particularly on mobile where fiddly grid selection is genuinely irritating. Invisible scoring, when it’s tuned properly, removes that friction entirely, which is the strongest argument in reCAPTCHA v3’s favour.

Accessibility tells a different story. hCaptcha publishes WCAG 2.1/2.2 guidance and a VPAT (Voluntary Product Accessibility Template), aiming to reduce reliance on audio challenges that are notoriously hard for people using screen readers, according to its own published materials. That said, any visual challenge still creates barriers for some visitors, no matter how well-intentioned the fallback options are.

Regional hosting affects latency, particularly for markets outside Western Europe and North America where a round trip to a distant server adds noticeable delay to page load.

Before you commit either vendor to production, test properly:

  • Try the checkout or signup flow on a real mid-range Android phone, not just your development laptop.
  • Run it through a screen reader like NVDA or VoiceOver.
  • Test on a throttled 3G connection to see how challenge loading affects perceived speed.
  • Check the language your challenges render in matches your actual visitor base.

How much do hCaptcha and reCAPTCHA cost?

reCAPTCHA’s free tier covers a moderate number of assessments monthly, comfortable territory for most small business sites, blogs and local shopfronts. Beyond that threshold, Google’s Enterprise pricing scales with volume and adds fraud signal features.

hCaptcha’s structure runs Publisher (free, ad-supported through the labelling model), Pro and Enterprise. The free tier is genuinely capable for low-to-moderate traffic sites, but invisible verification and the more advanced fraud tools sit behind paid tiers. Reported crossover points put hCaptcha ahead on cost once you’re pushing roughly 150,000 assessments a month, which matters if you’re scaling fast.

When modelling your own costs, factor in more than the headline assessment count. Overage charges, SLA commitments and the support tier that comes bundled with an enterprise contract all shift the real monthly figure. A busy e-commerce site processing thousands of checkouts a day needs a very different sum to a village hall booking form.

How do you migrate between hCaptcha and reCAPTCHA?

Switching vendors is rarely as daunting as it sounds. Cloudflare’s own migration documentation lays out the practical steps clearly:

  1. Swap the script tag and site key, which is often a two-line code change on both the client and server side.
  2. Map your score thresholds carefully. reCAPTCHA v3 treats higher scores as more human; some alternatives invert that logic, so a threshold copied blindly across can silently block real visitors or wave bots through.
  3. Run both systems in parallel on a staging environment first, watching false positive and false negative rates before you touch production.
  4. Roll back quickly if abandonment spikes on your critical endpoints, particularly checkout and account creation.
  5. Update your consent manager so the new script’s cookie behaviour (or lack of it) is reflected accurately in your banner timing.

Which CAPTCHA should you actually choose?

Pick hCaptcha if you’re handling EU-facing traffic, sit in a regulated sector, or simply want data minimisation baked in rather than bolted on afterwards. Its Zero PII model and regional processing make the compliance conversation shorter.

Pick reCAPTCHA if you’re a low-volume site already embedded in Google’s stack, want invisible scoring without paying for it, and don’t have a specific regulatory reason to avoid Google’s data flows.

Whichever you choose, pilot it properly first. Run a two-week trial across your genuinely critical endpoints, login, checkout and contact forms, and measure the challenge and abandonment rates before signing anything. Check accessibility on real devices, and document your transfer assessment before go-live, not after a regulator asks for it.

What we tell small business clients about CAPTCHA choices

Honestly? For most small sites we build, conversion and consent decide it, not theoretical accuracy scores. We pilot, we watch abandonment on the actual checkout or contact form, and we check the thing works with a screen reader before it goes anywhere near production. One thing clients forget: switching CAPTCHA vendors reduces your own data exposure, but you’re still the data controller. That responsibility doesn’t transfer with the widget.

— CRB

Sorting out your CAPTCHA the sensible way

There are other routes here: read the vendor docs yourself, wade through Google’s Enterprise pricing tables, run your own migration testing. Fair enough if you’ve got the time. But if you’d rather have someone who builds sites for a living just get it right first time, that’s where a web development service comes in.

Basic-BS

We build affordable, fast-turnaround websites for small businesses and events, and that includes sorting out the boring-but-critical stuff like CAPTCHA integration, cookie mapping and consent timing, without the eye-watering agency invoice usually attached to “compliance work.” Hosting, security, and updates are included so a privacy-aware CAPTCHA pilot fits naturally into maintenance work. Have a look at our website examples or check our services and pricing to see how we’d approach yours, and we’ll happily talk you through a short pilot before you commit to anything.

Sources

FAQ

Which is better, hCaptcha or reCAPTCHA?

hCaptcha suits privacy-sensitive and GDPR-focused deployments thanks to its Zero PII model and certifications; reCAPTCHA suits low-volume sites already tied to Google’s stack that want free invisible scoring.

What’s the difference between CAPTCHA and reCAPTCHA?

CAPTCHA is the general term for any test distinguishing humans from bots; reCAPTCHA is Google’s specific branded service, now largely behavioural scoring rather than visible puzzles in its v3 form.

How much does hCaptcha cost?

hCaptcha’s Publisher tier is free; Pro and Enterprise tiers add invisible verification and fraud tools, with reported cost crossover against reCAPTCHA around 150,000 monthly assessments.

What is hCaptcha and how does it work?

hCaptcha verifies visitors through image challenges or, on paid tiers, invisible Passive mode, and monetises by paying publishers for the labelling data solvers generate rather than selling behavioural data.

Is hCaptcha a good reCAPTCHA alternative for a small UK business site?

For most small sites, yes, particularly if you handle EU customer data, since its no-cookie option and regional processing simplify the GDPR conversation without needing an enterprise contract.

Back to blog