The difference
No tick-box bingo, but the figures a decision actually turns on: where processing happens, what the visitor is asked to do, and who owns the infrastructure. All taken from the providers' public documentation, with a date and a source.
The decision
All four services compared here stop bots. The difference lies in what they ask of your visitors along the way, and who gets to see that data.
01
If your visitors' IP addresses leave the EU, you need a legal basis for the third-country transfer and, in case of doubt, consent. That is the point at which a CAPTCHA ends up in your cookie banner.
02
Picture puzzles cost conversions and lock out people with visual impairments. A method that normally needs no interaction at all does not have that drawback.
03
A service that rents from a hyperscaler itself can only pass on what its own supplier promises. Whoever owns the machines can say bindingly where the data sits.
The facts
Instead of ticks and crosses, these are the actual values. Where we have no reliable public information, the entry reads „n/a“ — we do not guess.
| Figure | CaptchaCore | reCAPTCHA | hCaptcha | FriendlyCaptcha |
|---|---|---|---|---|
| Data protection & law | ||||
| Provider's registered office | Germany | USA / Ireland | USA | Germany |
| Place of processing | Germany | including the USA | including the USA | European Union |
| Transfer to third countries | none during verification | yes | yes | none |
| Cookies set by the widget | none | yes | yes | none |
| Consent in practice | in our assessment not required | usually required | usually required | per provider statement not required |
| Concluding the data processing agreement | electronically in the customer account | online supplementary terms | online supplementary terms | as a contract document |
| What your visitors experience | ||||
| picture puzzles possible | no | yes | yes | no |
| Interaction in the normal case | none | click through to picture puzzle | click through to picture puzzle | none |
| Widget size (gzip) | 16 KB | ~450 KB | ~65 KB | n/a |
| Own branding in the widget | yes | no | no | partly |
| Technology & operation | ||||
| Proof of Work | yes, SHA-256 and Argon2 | no | no | yes |
| Behavioural and environment signals | yes, as metrics and a hash | yes | yes | n/a |
| Protection mode for the whole website | yes, four levels | no | no | no |
| Reasoning behind the decision | Reason codes in the response | score without reasoning | score without reasoning | n/a |
| Operation on your own infrastructure | possible on request | not offered | not offered | n/a |
| Pricing model | free for private use, net plans for business | free with limits, Enterprise paid | free with limits, Enterprise paid | paid plans |
About these figures
On our own row: challenge, risk engine and database run exclusively in Germany. If a customer embeds the global rather than the European endpoint for the widget file, that file is delivered worldwide. This affects only the loading of the script, not the verification.
As of September 2026. Information about other providers comes from their public documentation and privacy notices, not from our own measurements. „Consent in practice“ is an assessment and does not replace legal advice; the assessment for your website is ultimately made by your data protection officer. If an entry is outdated or wrong, tell us and we will correct it.
One by one
A comparison in which the competition only looks bad is not a comparison. So for each provider, here is the strength first and then the point that becomes friction for an operator in Germany.
Strength
Detection is strong because Google combines signals from a vast portion of the web. The integration is documented everywhere, every CMS knows it, and the free tier fully covers small websites.
Where it rubs for you
That very strength is the problem: detection works because users are recognised across websites. For European operators that means third-country transfer, cookies and, as a rule, consent, plus picture puzzles for any visitor considered suspicious.
Strength
Created as an answer to reCAPTCHA, with comparable integration and a business model that is not based on advertising. Anyone wanting to move away from Google finds the shortest route here.
Where it rubs for you
The provider is still based in the USA, the widget sets cookies, and the picture puzzles remain. For European websites the switch changes little about the underlying legal issue.
Strength
A German provider, processing in the EU, proof of work instead of picture puzzles, no cookie. Of all the services compared here this is the approach closest to ours, and proof that it works without US infrastructure.
Where it rubs for you
The differences are in the detail: we run the hardware ourselves rather than renting it, return reason codes instead of just a score, protect the whole website on request rather than individual forms, allow your own branding in the widget, and let you conclude the data processing agreement directly in your account. For private websites we stay free permanently.
Staying honest
Proof of work and behavioural analysis require JavaScript. If a relevant share of your users browse without it, you need server-side protection instead, such as a honeypot or a check at firewall level.
If you want to bundle your CAPTCHA together with CDN, WAF and DNS at a single provider, you are better served by a platform that delivers all of it. We do one thing.
If your group governs data processing exclusively under US law and a German contracting party means extra effort, a US provider is simply the shorter route for you.
Switching
Changing your CAPTCHA is not a project, it is an afternoon. You need no downtime and can run both in parallel until you are satisfied.
01
Create a site with your domain in your account and copy the key. That takes a minute and costs nothing during the trial.
02
On WordPress, WoltLab, Symfony or Laravel a plugin or package handles it. Otherwise it is two lines in the form and one line on the server for the check.
03
Only once verifications run cleanly do the old script and its paragraph in the privacy policy go. We supply a ready-made passage for the new one.
The live demo shows the check from the visitor's side, including a simulated bot attack. After that you will know what this table is actually talking about.
Permanently free for private websites · Processing in Germany · Data processing agreement in your account