Researchers: Google's reCAPTCHA v3 raises privacy concerns with its cookie-based data collection and Google's suggestion to embed reCAPTCHA everywhere on a site
The latest version of the bot detector reCaptcha is invisible to users and has spread to more than 650,000 websites. Tweets: @othermaciej , @leighelse , @kdzwinel , @impressthenet , @_tijs , @johnwilander , and @thornedu Tweets: @othermaciej : The new reCAPTCHA is effectively a Google tracking pixel: https://www.fastcompany.com/ ... Else / @leighelse : Regrettably the day is coming when not having an #EvilGoogle account and blocking Google's tracking cookies will mean not being able to access large areas of the internet. https://www.fastcompany.com/ ... Konrad Dzwinel / @kdzwinel : „website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages" https://www.fastcompany.com/ ... In other words: let us track you or you won't be able to use internet. Doug Miller / @impressthenet : Google's new reCAPTCHA has a dark side https://buff.ly/2Xcnngf The latest version of the bot detector reCaptcha is invisible to users and has spread to more than 650,000 websites. It's great for security—but not so great for your privacy. pic.twitter.com/7otWarGVyl Tijs / @_tijs : Captcha v3 is live on 650k sites. Invisible to the user. Don't use Google products? You get a higher risk score. Have a high risk score? Sites will make access hard or impossible. Seems like an anti trust violation of epic proportions... https://www.fastcompany.com/ ... John Wilander / @johnwilander : “To make this risk-score system work accurately, website administrators are supposed to embed reCaptcha v3 code on all of the pages of their website, not just on forms or log-in pages. (...) Google did not address any potential privacy problems” https://www.fastcompany.com/ ... Randy Thornton / @thornedu : I told you this would happen. “Google's reCaptcha cookie follows the same logic of the Facebook “like” button when it's embedded in other website” RT @newsycombinator: Google's new reCAPTCHA has a dark side https://www.fastcompany.com/ ...
Context & Ripple Effects
The arc here runs from novelty to infrastructure: in 2017 Google introduced invisible reCAPTchas that score humans without a checkbox, then in October 2018 shipped the v3 API running adaptive risk analysis silently in the background. What researchers are flagging now is the flip side of that design — an invisible script on more than 650,000 sites whose cookie-based collection and sitewide-embedding guidance make it function, in one researcher's framing, as a Google tracking pixel.
The concern lands on ground already softened by Google itself: the Chrome 69 forced-login episode showed how silently changing privacy defaults burns user trust, and earlier coverage noted machine learning is approaching human-level at the tasks CAPTCHAs test, meaning the human-facing puzzle is fading while the invisible scoring layer grows.
First-order effects
- Webmasters following Google's suggestion to embed reCAPTCHA v3 on every page are installing a cookie-collecting Google script sitewide, exposing their visitors' browsing behavior to Google with no visible user consent moment.
- Users on those 650,000+ sites are already being scored invisibly today — the tracking happens whether or not they ever interact with a challenge.
Second-order effects
- As researcher commentary in the piece warns, users who block Google's tracking cookies may find themselves locked out of large parts of the web where v3 gates access — forcing a choice between privacy tooling and basic access.
- Anti-bot competitors gain a clear differentiation pitch: protection that doesn't route visitor signals through an advertising company, pressuring sites that care about privacy positioning to audit their CAPTCHA stack.
Third-order effects
- If machine learning keeps closing the gap on the tasks CAPTCHAs were built around, bot defense completes its shift from puzzles people solve to passive behavioral surveillance they never see — making embedded verification scripts a standing target for browser-level blocking and privacy regulation.
- The pattern points toward access itself becoming conditional on trusting a handful of large platforms, deepening the gatekeeper position Google already holds through search, Chrome, and ads.
The trend: Bot defense is quietly merging with cross-site tracking, turning ubiquitous anti-abuse widgets into surveillance infrastructure that browsers and privacy rules will increasingly have to police.