Aristotelis Zervos
Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protection, IT-Compliance and AI regulation.
Google has announced that it will reclassify its role in the use of reCAPTCHA under data protection law. From April 2, 2026, Google will no longer act as a controller in connection with reCAPTCHA, but as a processor within the meaning of Art. 4 No. 8 GDPR. What this means for companies in concrete terms and what they still need to pay attention to.
New distribution of roles from April 2026
The legal assessment of the previous allocation of roles was controversial for a long time. Google previously considered itself to be responsible for the data processed as part of reCAPTCHA. This meant that the company was responsible for the purposes and means of Processing including the option of using the information collected as part of the CAPTCHA checks for its own purposes.
This is precisely where the criticism of many data protectionists comes in. Although website operators technically integrate reCAPTCHA, they have only limited influence over how Google processes the user data collected in the process. In particular, there were complaints that the data processing could go beyond the mere prevention of abuse and be used by Google for analysis or improvement purposes. This raised considerable data protection issues with regard to the GDPR and § 25 TDDDG.
With the announcement at the beginning of 2026, Google is now making a fundamental adjustment. In future, an order processing contract will be provided for reCAPTCHA; the Google Cloud Data Processing Addendum.
Link tip: Google Data Processing Addendum
Under this arrangement, Google will, in the future, generally process the data collected through reCAPTCHA on behalf of and in accordance with the instructions of the respective website operators. As a result, the data may generally be processed only for the purpose of providing and securing the service, and no longer for Google’s own purposes.
The main responsibility under data protection law therefore clearly lies with the website operators who use reCAPTCHA.
Technically, everything remains the same with reCAPTCHA
The transition will not change the technical functioning of reCAPTCHA. Features, security mechanisms, and integrations will remain unchanged. The change affects only the allocation of roles under data protection law and the underlying contractual structure.
Google is already informing its customers about the change and points out that, in particular, the privacy policies on the respective websites should be updated.
Reading tip: These are the planned changes to cookie banners
What companies should now consider with reCAPTCHA
For companies, the new allocation of roles brings more clarity - but this does not mean a reduction in their own obligations. Anyone using reCAPTCHA will clearly be the controller within the meaning of Art. 4 No. 7 in future GDPR and must fulfill the associated data protection obligations.
Companies should therefore, in particular, review,
- whether reCAPTCHA is covered by the existing Google Data Processing Addendum,
- whether the updated contractual conditions have been effectively included,
- whether the Record of Processing Activities must be adapted,
- and whether the Privacy Policy transparently describes the new role allocation and data processing.
Classifying Google as a data processor therefore does not relieve companies of their obligations to verify and document compliance. Rather, it places even greater emphasis on these obligations.
The requirement for consent remains in many cases
Even if Google acts as a data processor in the future, the requirement for consent will remain unchanged in many cases.
When using reCAPTCHA, the following occurs regularly: Information stored on or retrieved from users' devices, about Cookies or other technical identifiers. The aim is to analyze the behavior of website visitors and detect automated access. As a result, their use continues to fall under Section 25 (1) TDDDG.
In practice, this means that reCAPTCHA should only be used regularly after a prior Consent be loaded via a consent management tool. Companies should therefore check this,
- whether the reCAPTCHA script is actually activated only after consent is given, and
- whether the service is correctly described in the content banner.
In addition, it may be advisable to explore less intrusive alternatives or to integrate reCAPTCHA in a way that minimizes data transfers as much as possible.
Have your website checked now
The transition is complete Compliance-From this perspective, it is a significant step. It brings an end to a long-standing debate over the division of roles under data protection law with regard to reCAPTCHA and provides greater clarity regarding the allocation of responsibility.
However, companies should not view this change as a mere formality. Rather, it provides an opportunity to conduct a structured review of their own use of reCAPTCHA from a technical, contractual, and organizational perspective.
Our experts help companies, Tracking- and to integrate security services such as reCAPTCHA in a legally compliant manner and to review existing websites for compliance with data protection laws.
As part of a website check, we analyze, among other things:
third-party services used and Tracking-Technologies
Consent mechanisms and consent banners
Data Transfers to Third Countries
Privacy Policy and Documentation Requirements
Simply get in touch with us.
Yussef Benjabri, Compliance Expert 2B Advice
Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with profound expertise in data protection, GDPR, IT-Compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR-Compliance and risk management. You can learn more about him on his Author profile page.
German 
English 
Italian 
French