Cloudflare says it will drop Google's reCAPTCHA bot detection service, as Google plans to charge for its use, and replace it with Intuition Machines' hCAPTCHA
Cloudflare says its moving to hCaptcha, an alternative CAPTCHA service, more private than reCAPTCHA.
Context & Ripple Effects
Google spent 2017-2018 making reCAPTCHA less visible to users — first invisible challenges with no checkbox, then v3's background adaptive risk analysis that scores every visitor. That reach is exactly what drew fire: researchers flagged v3's cookie-based data collection and Google's push to embed reCAPTCHA sitewide.
Cloudflare dropping reCAPTCHA for Intuition Machines' hCaptcha is the first big defection from that installed base, coming just as Google plans to charge for the service. The arc completes two years later when Cloudflare ships its own Turnstile, a privacy-preserving challenge that tests the browser instead of the user — suggesting the hCaptcha swap was a waypoint, not the destination.
First-order effects
- hCaptcha inherits Cloudflare's enormous proxied-traffic footprint overnight, making Intuition Machines one of the largest CAPTCHA providers on the web while Google loses that distribution channel.
- Millions of sites running behind Cloudflare switch their human-verification layer by default, with no integration work of their own.
Second-order effects
- Google's move to charge converts reCAPTCHA from a free default into a priced product, forcing every large publisher to weigh paid reCAPTCHA against hCaptcha and other alternatives on cost and privacy grounds.
- Intuition Machines' new traffic volume compounds its training-data advantage in bot detection, raising the bar for any rival trying to enter the category.
Third-order effects
- The pattern points to bot detection fragmenting away from a single free Google utility toward a competitive market of paid and privacy-positioned vendors, with privacy claims becoming a procurement criterion rather than a differentiator.
- Cloudflare's later Turnstile release suggests infrastructure providers ultimately internalize verification rather than rent it — a template other edge networks could follow.
The trend: As Google converts once-free web utilities into paid products, the infrastructure companies that distribute them are pulling those functions in-house or shifting to privacy-focused vendors.