Google has announced that it will reclassify its role in the use of reCAPTCHA under data protection law. From April 2, 2026, Google will no longer act as a controller in connection with reCAPTCHA, but as a processor within the meaning of Art. 4 No. 8 GDPR. What this means for companies in concrete terms and what they still need to pay attention to.
New distribution of roles from April 2026
The legal assessment of the previous allocation of roles was controversial for a long time. Google previously considered itself to be responsible for the data processed as part of reCAPTCHA. This meant that the company was responsible for the purposes and means of Processing including the option of using the information collected as part of the CAPTCHA checks for its own purposes.
This is precisely where the criticism of many data protectionists comes in. Although website operators technically integrate reCAPTCHA, they have only limited influence over how Google processes the user data collected in the process. In particular, there were complaints that the data processing could go beyond the mere prevention of abuse and be used by Google for analysis or improvement purposes. This raised considerable data protection issues with regard to the GDPR and § 25 TDDDG.
With the announcement at the beginning of 2026, Google is now making a fundamental adjustment. In future, an order processing contract will be provided for reCAPTCHA; the Google Cloud Data Processing Addendum.
Link tip: Google Data Processing Addendum
In this constellation, Google will in future process the data collected as part of reCAPTCHA on behalf of and in accordance with the instructions of the respective website operators. The data may therefore only be processed to provide and secure the service and no longer for Google's own purposes.
The main responsibility under data protection law therefore clearly lies with the website operators who use reCAPTCHA.
Technically, everything remains the same with reCAPTCHA
The technical functionality of reCAPTCHA will not change as a result of the changeover. Functions, protection mechanisms and integrations remain unchanged. The change only affects the allocation of roles under data protection law and the underlying contract structure.
Google is already informing its customers about the adjustment and points out that the data protection notices on the respective websites in particular should be updated.
Reading tip: These are the planned changes to cookie banners
What companies should now consider with reCAPTCHA
For companies, the new allocation of roles brings more clarity - but this does not mean a reduction in their own obligations. Anyone using reCAPTCHA will clearly be the controller within the meaning of Art. 4 No. 7 in future GDPR and must fulfill the associated data protection obligations.
Companies should therefore check in particular,
- whether reCAPTCHA is covered by the existing Google Data Processing Addendum,
- whether the updated contractual conditions have been effectively included,
- whether the List of processing activities must be adapted,
- and whether the Privacy policy transparently describes the new role allocation and data processing.
The classification of Google as a processor therefore does not release companies from their auditing and documentation obligations. On the contrary, it brings these obligations even more into focus.
Consent requirement remains in place in many cases
Even if Google acts as a processor in the future, the obligation to obtain consent will not change in many cases.
When using reCAPTCHA, the following data is regularly Information stored or read out on the user's end device, about Cookies or other technical identifiers. The aim is to analyze the behavior of website visitors and detect automated access. As a result, their use continues to fall under Section 25 (1) TDDDG.
In practice, this means that reCAPTCHA should only be used regularly after a prior Consent be loaded via a consent management tool. Companies should therefore check this,
- whether the reCAPTCHA script is actually only activated after approval and
- whether the service is correctly described in the content banner.
In addition, it may make sense to examine less intrusive alternatives or to integrate reCAPTCHA technically in such a way that data transmissions are reduced as much as possible.
Have your website checked now
The changeover is a significant step from a compliance perspective. It ends a long-standing discussion about the allocation of roles under data protection law with reCAPTCHA and creates more clarity in the allocation of responsibilities.
However, companies should not see the change as a mere formality. Rather, it provides an opportunity to review their own integration of reCAPTCHA from a technical, contractual and organizational perspective.
Our experts support companies in integrating tracking and security services such as reCAPTCHA in a legally compliant manner and reviewing existing websites in terms of data protection law.
As part of a website check, we analyze, among other things:
Third-party services and tracking technologies used
Consent mechanisms and consent banners
Data transfers to third countries
Privacy policy and documentation obligations
Simply get in touch with us.
Yussef Benjabri, Compliance Expert 2B Advice
German 
English 
Italian 
French