This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data.
I was reading briefly about ePrivacy regulations and I have found very good resource about PECR and cookies at ICO. I have tried to contact ICO via their Live chat, but unfortunately they don't provide any legal advice. However, they said - "If you're collecting personal data, then you must comply with GDPR."
From what I could find online and from what I can see in browser, Google's reCAPTCHA is collecting client's hardware and software information in order to analyse if the client is human or robot. Some of the cookies are sent to google.com. Some unofficial sources say that Google even use their GA tracking cookie to identify human vs. bot. In my understanding this approach can be seen as tracking or fingerprinting.
So I'm wondering how is it actually from legal point of view? Do we really need to obtain user's consent before we can use Google's reCAPTCHA on website served to EU citizens?
ICO says, there are exemptions for
session cookies providing security that is essential to comply with data protection security...
Can be reCAPTCHA considered as tool for providing data protection security?
My point is that no bot will ever give consent to reCAPTCHA, so what is way out of this riddle?
UPDATE (2018-05-07) I noticed Google updated their EU user consent policy, that is linked from reCAPTCHA admin, located here: Their terms of service:
...it is your responsibility to provide any necessary notices or consents for the collection and sharing of this data with Google. For users in the European Union, you and your API Client(s) must comply with the EU User Consent Policy currently located at http://www.google.com/about/company/user-consent-policy.html.
So assuming the consent is required, I would like to rephrase my original question:
If I offer ways to give consent and/or deny reCAPTCHA; Is it legally acceptable to include and execute reCAPTCHA on website by default without prior consent?