Is reCAPTCHA GDPR compliant in 2026?

Not by default. reCAPTCHA collects behavioral data, device fingerprints, and sets cross-site cookies — all of which require explicit user consent under GDPR and the ePrivacy Directive. After April 2, 2026, site operators become the sole data controller for this data. CNIL's EUR 25,000 fine against Cityscoot confirms that deploying reCAPTCHA without consent violates EU law.

What happens if I keep using reCAPTCHA without a consent banner?

You risk GDPR enforcement. Spain's DPA alone issued 932 fines through early 2026, with "insufficient legal basis" as the top violation. The Cityscoot precedent specifically targets reCAPTCHA consent failures. After the April 2 processor switch, you can't rely on Google's controllership as a shield.

Is Cloudflare Turnstile really free?

Yes — unlimited requests at every tier, including enterprise. Turnstile doesn't set cookies or collect personal data, so it doesn't require a consent banner. It runs on Cloudflare's edge network with negligible performance impact.

Can I use reCAPTCHA behind a cookie consent banner to stay compliant?

Technically yes, but it creates problems. If a visitor rejects cookies, your bot protection doesn't load — leaving that session completely unprotected. Research shows 50-66% of users now reject cookies when given a clear option. That means half your visitors get no bot protection at all.

Which CAPTCHA alternative is best for e-commerce?

Cloudflare Turnstile. E-commerce sites are especially sensitive to CAPTCHA friction — Baymard Institute found an 8% first-attempt failure rate for traditional CAPTCHAs, and Stanford research shows up to 40% conversion drops. Turnstile is invisible, free, fast, and doesn't require consent.