22

This question is specifically about Google's reCAPTCHA, but may possibly apply to many other CAPTCHA solutions that are collecting "personal" data.

I was reading briefly about ePrivacy regulations and I have found very good resource about PECR and cookies at ICO. I have tried to contact ICO via their Live chat, but unfortunately they don't provide any legal advice. However, they said - "If you're collecting personal data, then you must comply with GDPR."

From what I could find online and from what I can see in browser, Google's reCAPTCHA is collecting client's hardware and software information in order to analyse if the client is human or robot. Some of the cookies are sent to google.com. Some unofficial sources say that Google even use their GA tracking cookie to identify human vs. bot. In my understanding this approach can be seen as tracking or fingerprinting.

So I'm wondering how is it actually from legal point of view? Do we really need to obtain user's consent before we can use Google's reCAPTCHA on website served to EU citizens?

ICO says, there are exemptions for

session cookies providing security that is essential to comply with data protection security...

Can be reCAPTCHA considered as tool for providing data protection security?

My point is that no bot will ever give consent to reCAPTCHA, so what is way out of this riddle?

UPDATE (2018-05-07) I noticed Google updated their EU user consent policy, that is linked from reCAPTCHA admin, located here: Their terms of service:

...it is your responsibility to provide any necessary notices or consents for the collection and sharing of this data with Google. For users in the European Union, you and your API Client(s) must comply with the EU User Consent Policy currently located at http://www.google.com/about/company/user-consent-policy.html.

So assuming the consent is required, I would like to rephrase my original question:

If I offer ways to give consent and/or deny reCAPTCHA; Is it legally acceptable to include and execute reCAPTCHA on website by default without prior consent?

Improve this question
2
  • 1
    "no bot will ever give consent": why not? If the bot is trying to fool you into thinking it's a person, it would of course consent. Anyway, if the thing is a bot there should be no liability under GDPR, because there's no personal data, is there?
    – phoog
    Apr 28, 2018 at 15:25
  • Also I'm struggling to understand how reCAPTCHA could put a data processor in possession of personal data without consent. Wouldn't the person using reCAPTCHA either be anonymous, in which case GDPR does not apply, or have given consent to the data processing?
    – phoog
    Apr 28, 2018 at 15:34

4 Answers 4

Reset to default
10

“From your perspective you should not worry about asking permission to use reCaptcha as it is not you who is processing the data it is google and any GDPR compliance falls on them.“

This is plain wrong. If a user visits your website you are the controller of data collected on your website. Regardless of what entity collects that data.

However in my non-legal opinion reCAPTCHA falls under Article 6 section 1d and 1f. Also Recital 49.

1d:

“processing is necessary in order to protect the vital interests of the data subject or of another natural person;”

While you could argue in some cases (most probably) reCAPTCHA is used to reduce spam to a business entity thus not a “natural person”.

1f:

“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Here is where the real ruling applies “Legitimate interests”. You as a business have a legitimate interest in reducing spam into your business. Not only does spam take up your time but it also takes up your resources. As to the extent in which spam takes up is dependent on the usage in question. But nearly everyone can safely assume reducing spam (one of the cornerstones of the GDPR) is a legitimate interest.

Recital 49 (excerpt):

The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.

Improve this answer
3
  • 2
    1d is likely not applicable, as spam is not a matter of life or death ("vital interest") in most cases. 1d is intended for disaster relief type of situations. However, I agree that legitimate interests is the most likely choice to work. You just have to do the work (document the interest-balancing exercise in advance).
    – ibid
    Jan 5, 2019 at 14:45
  • While yes 1d would generally not apply. There are avenues which it MAY or MAY NOT. Specifically bots may hit a page attempting to input stolen data. With reCAPTCHA in place the shitty bots aren't allowed to attempt to verify the stolen data. So while it's a stretch and a very specific scenario it could still apply.
    – Shinrai
    Jan 5, 2019 at 16:21
  • @Shinrai The case from your comment still clearly does not fall under 1d, not even with a stretch, because, once again, “vital interests” cover disasters, “physical integrity of life”, etc. What you describe is 1f, as it is a matter of information security, as explained in Article 49.
    – kirelagin
    Sep 6, 2019 at 10:35
1
+50

Are you looking from Google's perspective or your perspective?

From your perspective you should not worry about asking permission to use reCaptcha as it is not you who is processing the data it is google and any GDPR compliance falls on them.

From their perspective, it should not be a concern, GDPR is worried about Personally Identifiable Information and so 99% of hardware and software data and any tracking data with regards to your cursor movement to see if you are a robot or not will not fall under that category. Data which they could store would be like IP addresses which are protected under GDPR in most cases.

Improve this answer
2
  • 5
    you should not worry about asking permission to use reCaptcha as it is not you who is processing the data this is exactly the reasoning that made GDPR possible:)
    – lp1051
    May 7, 2018 at 18:33
  • 12
    The user must know what data you collect and how you use their data, including whether you give part of it to Google or any other external services. By embedding a third-party service in your website, you are responsible for knowing what it does and informing the user.
    – reed
    May 28, 2018 at 13:25
1

You wouldn't need consent for this type of cookie as it would be in the legitimate interest of the data controller to collect this information. The user completing a form and ticking a reCAPTCHA would be submitting data to the data controller anyway. Asking for consent would be silly if there is a real interest for the controller

Improve this answer
-1

The only thing I can imagine is to disable form submission by default and enable form submission together with reCAPTCHA on demand, after user gave consent to use reCAPTCHA.

Improve this answer
2
  • 1
    That's not how the GDPR works. Consent has to be meaningful.
    – MSalters
    May 4, 2018 at 7:27
  • I don't understand what you want to say. In my opinion reCAPTCHA get's loaded on every page where it is contained, no matter if the user actually want to submit forms and uses the service. The service might be used to collect personal data (at least IP Address) and track users, with no way to opt out. At least that way, not loading reCAPTCHA and disabling form submit to prevent spam, the user has the possibility to opt-out.
    – LarS
    May 4, 2018 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .