ReCAPTCHA - Revision history

Rudxain: wanted: cookies

2026-02-26T06:57:24Z

wanted: cookies

← Older revision		Revision as of 06:57, 26 February 2026
Line 15:		Line 15:
	A video published by YouTube channel CHUPPL sparked renewed controversy with a video released in December 2024. The video cites and details how reCAPTCHA [[wikipedia:Doxing\|doxxes]] users and how resulting user data can end up in the hands of the US government for unknown purposes, claiming exploitation of an intentional loophole in Google's terms of service allowing them to transmit user device and application data under the guise of "general security purposes."<ref>{{Cite web \|last=CHUPPL \|date=5 Dec 2024 \|title=Why reCAPTCHA is Spyware \|url=https://www.youtube.com/watch?v=VTsBP21-XpI \|via=YouTube \|archive-url=https://preservetube.com/watch?v=VTsBP21-XpI \|archive-date=22 Feb 2026}}</ref> User data allegedly began being collected in 2014, when Google deployed reCAPTCHA v2, specifically the “No CAPTCHA reCAPTCHA” i.e. "the checkbox CAPTCHA," which primarily uses [[wikipedia:HTTP_cookie\|cookies]] to whitelist users who reCAPTCHA identifies as humans. This opens up additional security vulnerabilities as once a user is identified as a human, a bot can take over and be given unrestricted access to all sites using reCAPTCHA without having to fill a CAPTCHA itself.<ref>{{Cite web \|last=homakov \|date=4 Dec 2014 \|title=The No CAPTCHA problem \|url=https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|url-status=live \|archive-url=https://web.archive.org/web/20141204133024/https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|archive-date=4 Dec 2014 \|via=Blogger}}</ref>		A video published by YouTube channel CHUPPL sparked renewed controversy with a video released in December 2024. The video cites and details how reCAPTCHA [[wikipedia:Doxing\|doxxes]] users and how resulting user data can end up in the hands of the US government for unknown purposes, claiming exploitation of an intentional loophole in Google's terms of service allowing them to transmit user device and application data under the guise of "general security purposes."<ref>{{Cite web \|last=CHUPPL \|date=5 Dec 2024 \|title=Why reCAPTCHA is Spyware \|url=https://www.youtube.com/watch?v=VTsBP21-XpI \|via=YouTube \|archive-url=https://preservetube.com/watch?v=VTsBP21-XpI \|archive-date=22 Feb 2026}}</ref> User data allegedly began being collected in 2014, when Google deployed reCAPTCHA v2, specifically the “No CAPTCHA reCAPTCHA” i.e. "the checkbox CAPTCHA," which primarily uses [[wikipedia:HTTP_cookie\|cookies]] to whitelist users who reCAPTCHA identifies as humans. This opens up additional security vulnerabilities as once a user is identified as a human, a bot can take over and be given unrestricted access to all sites using reCAPTCHA without having to fill a CAPTCHA itself.<ref>{{Cite web \|last=homakov \|date=4 Dec 2014 \|title=The No CAPTCHA problem \|url=https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|url-status=live \|archive-url=https://web.archive.org/web/20141204133024/https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|archive-date=4 Dec 2014 \|via=Blogger}}</ref>

	The type of cookies collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>		The type of [[Web_cookie\|cookies]] collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>

	*Screen size and resolution, date, language, browser plug-ins, and all [[JavaScript]] objects		*Screen size and resolution, date, language, browser plug-ins, and all [[JavaScript]] objects

Rudxain: wanted: JS

2026-02-23T18:42:46Z

wanted: JS

← Older revision		Revision as of 18:42, 23 February 2026
Line 17:		Line 17:
	The type of cookies collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>		The type of cookies collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>

	*Screen size and resolution, date, language, browser plug-ins, and all ~~Javascript~~ objects		*Screen size and resolution, date, language, browser plug-ins, and all [[JavaScript]] objects
	*IP address		*IP address
	*CSS information from the page you are on		*CSS information from the page you are on

Bananabot: Added archive URLs for 1 citation(s) using CRWCitationBot

2026-02-23T12:55:32Z

Added archive URLs for 1 citation(s) using CRWCitationBot

← Older revision		Revision as of 12:55, 23 February 2026
Line 22:		Line 22:
	*A count of mouse and touch events		*A count of mouse and touch events

	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20 \|archive-url=http://web.archive.org/web/20250825040226/https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|archive-date=25 Aug 2025}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/ \|archive-url=http://web.archive.org/web/20260222200003/https://antcpt.com/score_detector/ \|archive-date=22 Feb 2026}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/ \|archive-url=http://web.archive.org/web/20260222200003/https://antcpt.com/score_detector/ \|archive-date=22 Feb 2026}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

Bananabot: Added archive URLs for 1 citation(s) using CRWCitationBot

2026-02-23T07:13:25Z

Added archive URLs for 1 citation(s) using CRWCitationBot

← Older revision		Revision as of 07:13, 23 February 2026
Line 24:		Line 24:
	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/ \|archive-url=http://web.archive.org/web/20260222200003/https://antcpt.com/score_detector/ \|archive-date=22 Feb 2026}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

	reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>		reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>

Bananabot: Added archive URLs for 9 citation(s) using CRWCitationBot

2026-02-22T19:43:40Z

Added archive URLs for 9 citation(s) using CRWCitationBot

← Older revision		Revision as of 19:43, 22 February 2026
Line 11:		Line 11:
	}}		}}
	{{lowercase title}}		{{lowercase title}}
	[[wikipedia:ReCAPTCHA\|'''reCAPTCHA''']] was acquired by [[Google]] in 2009 and has since been used to protect websites from [[wikipedia:Internet_bot\|botting]], crowdsource transcription work, and to mass train Google's other technical ventures such as artificial intelligence.<ref>{{Cite web \|last=von Ahn \|first=Luis \|last2=Cathcart \|first2=Will \|date=16 Sep 2009 \|title=Teaching computers to read: Google acquires reCAPTCHA \|url=https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|url-status=live \|archive-url=https://web.archive.org/web/20090917225140/https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|archive-date=17 Sep 2009 \|website=Google Blog}}</ref><ref>{{cite web \|author=<!-- not stated -->\|title= Google recaptcha intro on using reCaptcha to improve automation \|url=https://www.google.com/recaptcha/intro/?hl=es/index.html#:~:text=Every%20time%20our%20CAPTCHAs%20are,and%20solve%20hard%20AI%20problems. \|website=google.com \|access-date=2025-02-15}}</ref> Google faced criticism over this crowdsourcing and training for using unpaid labor from millions of daily users around the world, even sparking an ultimately unsuccessful class action lawsuit in Massachusetts in 2015, with the court dismissing the amount of time spent by each user completing a CAPTCHA as "something for which [no] reasonable consumer would expect to receive compensation".<ref>{{Cite web \|date=22 Jan 2015 \|title=Civil Action No. 15-10160-MGM \|url=https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical \|website=United States District Court for the District of Massachusetts}}</ref><ref>{{Cite web \|date=3 Feb 2016 \|title=Case No. 15-cv-03751-JSC \|url=https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc \|website=United States District Court for the Northern District of California}}</ref>		[[wikipedia:ReCAPTCHA\|'''reCAPTCHA''']] was acquired by [[Google]] in 2009 and has since been used to protect websites from [[wikipedia:Internet_bot\|botting]], crowdsource transcription work, and to mass train Google's other technical ventures such as artificial intelligence.<ref>{{Cite web \|last=von Ahn \|first=Luis \|last2=Cathcart \|first2=Will \|date=16 Sep 2009 \|title=Teaching computers to read: Google acquires reCAPTCHA \|url=https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|url-status=live \|archive-url=https://web.archive.org/web/20090917225140/https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|archive-date=17 Sep 2009 \|website=Google Blog}}</ref><ref>{{cite web \|author=<!-- not stated -->\|title= Google recaptcha intro on using reCaptcha to improve automation \|url=https://www.google.com/recaptcha/intro/?hl=es/index.html#:~:text=Every%20time%20our%20CAPTCHAs%20are,and%20solve%20hard%20AI%20problems. \|website=google.com \|access-date=2025-02-15 \|archive-url=http://web.archive.org/web/20240213195538/https://www.google.com/recaptcha/intro/?hl=es/index.html \|archive-date=13 Feb 2024}}</ref> Google faced criticism over this crowdsourcing and training for using unpaid labor from millions of daily users around the world, even sparking an ultimately unsuccessful class action lawsuit in Massachusetts in 2015, with the court dismissing the amount of time spent by each user completing a CAPTCHA as "something for which [no] reasonable consumer would expect to receive compensation".<ref>{{Cite web \|date=22 Jan 2015 \|title=Civil Action No. 15-10160-MGM \|url=https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical \|website=United States District Court for the District of Massachusetts \|archive-url=http://web.archive.org/web/20240603123901/https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical \|archive-date=3 Jun 2024}}</ref><ref>{{Cite web \|date=3 Feb 2016 \|title=Case No. 15-cv-03751-JSC \|url=https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc \|website=United States District Court for the Northern District of California \|archive-url=http://web.archive.org/web/20250220162937/https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc \|archive-date=20 Feb 2025}}</ref>

	A video published by YouTube channel CHUPPL sparked renewed controversy with a video released in December 2024. The video cites and details how reCAPTCHA [[wikipedia:Doxing\|doxxes]] users and how resulting user data can end up in the hands of the US government for unknown purposes, claiming exploitation of an intentional loophole in Google's terms of service allowing them to transmit user device and application data under the guise of "general security purposes."<ref>{{Cite web \|last=CHUPPL \|date=5 Dec 2024 \|title=Why reCAPTCHA is Spyware \|url=https://www.youtube.com/watch?v=VTsBP21-XpI \|via=YouTube}}</ref> User data allegedly began being collected in 2014, when Google deployed reCAPTCHA v2, specifically the “No CAPTCHA reCAPTCHA” i.e. "the checkbox CAPTCHA," which primarily uses [[wikipedia:HTTP_cookie\|cookies]] to whitelist users who reCAPTCHA identifies as humans. This opens up additional security vulnerabilities as once a user is identified as a human, a bot can take over and be given unrestricted access to all sites using reCAPTCHA without having to fill a CAPTCHA itself.<ref>{{Cite web \|last=homakov \|date=4 Dec 2014 \|title=The No CAPTCHA problem \|url=https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|url-status=live \|archive-url=https://web.archive.org/web/20141204133024/https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|archive-date=4 Dec 2014 \|via=Blogger}}</ref>		A video published by YouTube channel CHUPPL sparked renewed controversy with a video released in December 2024. The video cites and details how reCAPTCHA [[wikipedia:Doxing\|doxxes]] users and how resulting user data can end up in the hands of the US government for unknown purposes, claiming exploitation of an intentional loophole in Google's terms of service allowing them to transmit user device and application data under the guise of "general security purposes."<ref>{{Cite web \|last=CHUPPL \|date=5 Dec 2024 \|title=Why reCAPTCHA is Spyware \|url=https://www.youtube.com/watch?v=VTsBP21-XpI \|via=YouTube \|archive-url=https://preservetube.com/watch?v=VTsBP21-XpI \|archive-date=22 Feb 2026}}</ref> User data allegedly began being collected in 2014, when Google deployed reCAPTCHA v2, specifically the “No CAPTCHA reCAPTCHA” i.e. "the checkbox CAPTCHA," which primarily uses [[wikipedia:HTTP_cookie\|cookies]] to whitelist users who reCAPTCHA identifies as humans. This opens up additional security vulnerabilities as once a user is identified as a human, a bot can take over and be given unrestricted access to all sites using reCAPTCHA without having to fill a CAPTCHA itself.<ref>{{Cite web \|last=homakov \|date=4 Dec 2014 \|title=The No CAPTCHA problem \|url=https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|url-status=live \|archive-url=https://web.archive.org/web/20141204133024/https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|archive-date=4 Dec 2014 \|via=Blogger}}</ref>

	The type of cookies collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>		The type of cookies collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>
Line 22:		Line 22:
	*A count of mouse and touch events		*A count of mouse and touch events

	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator}}</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

	reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>		reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>

Snarfblat: Cited and reworded claim about Google making reCAPTCHA succeed more often on Chromium-based browsers.

2026-02-20T14:31:05Z

Cited and reworded claim about Google making reCAPTCHA succeed more often on Chromium-based browsers.

← Older revision		Revision as of 14:31, 20 February 2026
Line 22:		Line 22:
	*A count of mouse and touch events		*A count of mouse and touch events

	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>~~Google has also been accused~~ of ~~allowing reCAPTCHA to accept users running [[Chromium]] web~~ browsers ~~more frequently than alternatives~~.{{~~Citation needed~~}} Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator}}</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator}}</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

Bythmusters: Started cargo

2026-01-26T15:34:26Z

Started cargo

← Older revision		Revision as of 15:34, 26 January 2026
Line 1:		Line 1:
	{{~~InfoboxProductLine~~		{{ProductCargo
	\| ~~Title~~ = ~~reCAPTCHA~~		\|ArticleType=
	\| ~~Release Year~~ = ~~2007~~		\|Category=Software, CAPTCHA
	\| ~~Product Type~~ = ~~CAPTCHA and behavioral analysis~~		\|Company=Google
	\| ~~In Production~~ = Yes		\|Description=
	\| ~~Official~~ Website = https://google.com/recaptcha		\|InProduction=Yes
	~~\| Logo = ReCAPTCHA.svg~~		\|Logo=ReCAPTCHA.svg
			\|ProductLine=
			\|ReleaseYear=2007
			\|Website=https://google.com/recaptcha
	}}		}}
	{{lowercase title}}		{{lowercase title}}

AnotherConsumerRightsPerson at 19:36, 3 October 2025

2025-10-03T19:36:10Z

← Older revision		Revision as of 19:36, 3 October 2025
Line 7:		Line 7:
	\| Logo = ReCAPTCHA.svg		\| Logo = ReCAPTCHA.svg
	}}		}}
			{{lowercase title}}
	[[wikipedia:ReCAPTCHA\|'''reCAPTCHA''']] was acquired by [[Google]] in 2009 and has since been used to protect websites from [[wikipedia:Internet_bot\|botting]], crowdsource transcription work, and to mass train Google's other technical ventures such as artificial intelligence.<ref>{{Cite web \|last=von Ahn \|first=Luis \|last2=Cathcart \|first2=Will \|date=16 Sep 2009 \|title=Teaching computers to read: Google acquires reCAPTCHA \|url=https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|url-status=live \|archive-url=https://web.archive.org/web/20090917225140/https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|archive-date=17 Sep 2009 \|website=Google Blog}}</ref><ref>{{cite web \|author=<!-- not stated -->\|title= Google recaptcha intro on using reCaptcha to improve automation \|url=https://www.google.com/recaptcha/intro/?hl=es/index.html#:~:text=Every%20time%20our%20CAPTCHAs%20are,and%20solve%20hard%20AI%20problems. \|website=google.com \|access-date=2025-02-15}}</ref> Google faced criticism over this crowdsourcing and training for using unpaid labor from millions of daily users around the world, even sparking an ultimately unsuccessful class action lawsuit in Massachusetts in 2015, with the court dismissing the amount of time spent by each user completing a CAPTCHA as "something for which [no] reasonable consumer would expect to receive compensation".<ref>{{Cite web \|date=22 Jan 2015 \|title=Civil Action No. 15-10160-MGM \|url=https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical \|website=United States District Court for the District of Massachusetts}}</ref><ref>{{Cite web \|date=3 Feb 2016 \|title=Case No. 15-cv-03751-JSC \|url=https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc \|website=United States District Court for the Northern District of California}}</ref>		[[wikipedia:ReCAPTCHA\|'''reCAPTCHA''']] was acquired by [[Google]] in 2009 and has since been used to protect websites from [[wikipedia:Internet_bot\|botting]], crowdsource transcription work, and to mass train Google's other technical ventures such as artificial intelligence.<ref>{{Cite web \|last=von Ahn \|first=Luis \|last2=Cathcart \|first2=Will \|date=16 Sep 2009 \|title=Teaching computers to read: Google acquires reCAPTCHA \|url=https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|url-status=live \|archive-url=https://web.archive.org/web/20090917225140/https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|archive-date=17 Sep 2009 \|website=Google Blog}}</ref><ref>{{cite web \|author=<!-- not stated -->\|title= Google recaptcha intro on using reCaptcha to improve automation \|url=https://www.google.com/recaptcha/intro/?hl=es/index.html#:~:text=Every%20time%20our%20CAPTCHAs%20are,and%20solve%20hard%20AI%20problems. \|website=google.com \|access-date=2025-02-15}}</ref> Google faced criticism over this crowdsourcing and training for using unpaid labor from millions of daily users around the world, even sparking an ultimately unsuccessful class action lawsuit in Massachusetts in 2015, with the court dismissing the amount of time spent by each user completing a CAPTCHA as "something for which [no] reasonable consumer would expect to receive compensation".<ref>{{Cite web \|date=22 Jan 2015 \|title=Civil Action No. 15-10160-MGM \|url=https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical \|website=United States District Court for the District of Massachusetts}}</ref><ref>{{Cite web \|date=3 Feb 2016 \|title=Case No. 15-cv-03751-JSC \|url=https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc \|website=United States District Court for the Northern District of California}}</ref>

InTransparencyWeTrust: improve references with additional information

2025-03-10T13:53:42Z

improve references with additional information

← Older revision		Revision as of 13:53, 10 March 2025
Line 8:		Line 8:
	}}		}}

	[[wikipedia:ReCAPTCHA\|'''reCAPTCHA''']] was acquired by [[Google]] in 2009 and has since been used to protect websites from [[wikipedia:Internet_bot\|botting]], crowdsource transcription work, and to mass train Google's other technical ventures such as artificial intelligence.<ref>https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html</ref><ref>{{cite web \|author=<!-- not stated -->\|title= Google recaptcha intro on using reCaptcha to improve automation \|url=https://www.google.com/recaptcha/intro/?hl=es/index.html#:~:text=Every%20time%20our%20CAPTCHAs%20are,and%20solve%20hard%20AI%20problems. \|website=google.com \|access-date=2025-02-15}}</ref> Google faced criticism over this crowdsourcing and training for using unpaid labor from millions of daily users around the world, even sparking an ultimately unsuccessful class action lawsuit in Massachusetts in 2015, with the court dismissing the amount of time spent by each user completing a CAPTCHA as "something for which [no] reasonable consumer would expect to receive compensation".<ref>https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical</ref><ref>https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc</ref>		[[wikipedia:ReCAPTCHA\|'''reCAPTCHA''']] was acquired by [[Google]] in 2009 and has since been used to protect websites from [[wikipedia:Internet_bot\|botting]], crowdsource transcription work, and to mass train Google's other technical ventures such as artificial intelligence.<ref>{{Cite web \|last=von Ahn \|first=Luis \|last2=Cathcart \|first2=Will \|date=16 Sep 2009 \|title=Teaching computers to read: Google acquires reCAPTCHA \|url=https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|url-status=live \|archive-url=https://web.archive.org/web/20090917225140/https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html \|archive-date=17 Sep 2009 \|website=Google Blog}}</ref><ref>{{cite web \|author=<!-- not stated -->\|title= Google recaptcha intro on using reCaptcha to improve automation \|url=https://www.google.com/recaptcha/intro/?hl=es/index.html#:~:text=Every%20time%20our%20CAPTCHAs%20are,and%20solve%20hard%20AI%20problems. \|website=google.com \|access-date=2025-02-15}}</ref> Google faced criticism over this crowdsourcing and training for using unpaid labor from millions of daily users around the world, even sparking an ultimately unsuccessful class action lawsuit in Massachusetts in 2015, with the court dismissing the amount of time spent by each user completing a CAPTCHA as "something for which [no] reasonable consumer would expect to receive compensation".<ref>{{Cite web \|date=22 Jan 2015 \|title=Civil Action No. 15-10160-MGM \|url=https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1904&context=historical \|website=United States District Court for the District of Massachusetts}}</ref><ref>{{Cite web \|date=3 Feb 2016 \|title=Case No. 15-cv-03751-JSC \|url=https://casetext.com/case/rojas-lozano-ex-rel-all-other-persons-similarly-situated-v-google-inc \|website=United States District Court for the Northern District of California}}</ref>

	A video published by YouTube channel CHUPPL sparked renewed controversy with a video released in December 2024. The video cites and details how reCAPTCHA [[wikipedia:Doxing\|doxxes]] users and how resulting user data can end up in the hands of the US government for unknown purposes, claiming exploitation of an intentional loophole in Google's terms of service allowing them to transmit user device and application data under the guise of "general security purposes."<ref>https://www.youtube.com/watch?v=VTsBP21-XpI&t=~~306s~~</ref> User data allegedly began being collected in 2014, when Google deployed reCAPTCHA v2, specifically the “No CAPTCHA reCAPTCHA” i.e. "the checkbox CAPTCHA," which primarily uses [[wikipedia:HTTP_cookie\|cookies]] to whitelist users who reCAPTCHA identifies as humans. This opens up additional security vulnerabilities as once a user is identified as a human, a bot can take over and be given unrestricted access to all sites using reCAPTCHA without having to fill a CAPTCHA itself.<ref>https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html</ref>		A video published by YouTube channel CHUPPL sparked renewed controversy with a video released in December 2024. The video cites and details how reCAPTCHA [[wikipedia:Doxing\|doxxes]] users and how resulting user data can end up in the hands of the US government for unknown purposes, claiming exploitation of an intentional loophole in Google's terms of service allowing them to transmit user device and application data under the guise of "general security purposes."<ref>{{Cite web \|last=CHUPPL \|date=5 Dec 2024 \|title=Why reCAPTCHA is Spyware \|url=https://www.youtube.com/watch?v=VTsBP21-XpI \|via=YouTube}}</ref> User data allegedly began being collected in 2014, when Google deployed reCAPTCHA v2, specifically the “No CAPTCHA reCAPTCHA” i.e. "the checkbox CAPTCHA," which primarily uses [[wikipedia:HTTP_cookie\|cookies]] to whitelist users who reCAPTCHA identifies as humans. This opens up additional security vulnerabilities as once a user is identified as a human, a bot can take over and be given unrestricted access to all sites using reCAPTCHA without having to fill a CAPTCHA itself.<ref>{{Cite web \|last=homakov \|date=4 Dec 2014 \|title=The No CAPTCHA problem \|url=https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|url-status=live \|archive-url=https://web.archive.org/web/20141204133024/https://homakov.blogspot.com/2014/12/the-no-captcha-problem.html \|archive-date=4 Dec 2014 \|via=Blogger}}</ref>

	The type of cookies collected includes, but is not limited to:<ref name=":0">https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2</ref>		The type of cookies collected includes, but is not limited to:<ref name=":0">{{Cite web \|last=O'Reilly \|first=Lara \|date=20 Feb 2015 \|title=Google's new CAPTCHA security login raises 'legitimate privacy concerns' \|url=https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|url-status=live \|archive-url=https://web.archive.org/web/20150222100003/https://www.businessinsider.com/google-no-captcha-adtruth-privacy-research-2015-2 \|archive-date=22 Feb 2015 \|website=Business Insider}}</ref>

	*Screen size and resolution, date, language, browser plug-ins, and all Javascript objects		*Screen size and resolution, date, language, browser plug-ins, and all Javascript objects
Line 19:		Line 19:
	*A count of mouse and touch events		*A count of mouse and touch events

	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>https://trends.builtwith.com/widgets/captcha</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">https://arxiv.org/pdf/2311.10911</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Google has also been accused of allowing reCAPTCHA to accept users running [[Chromium]] web browsers more frequently than alternatives.{{Citation needed}} Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>https://news.ycombinator.com/item?id=20147015</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Google has also been accused of allowing reCAPTCHA to accept users running [[Chromium]] web browsers more frequently than alternatives.{{Citation needed}} Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator}}</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>https://www.popsci.com/google-invisible-recaptcha/</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>https://developers.google.com/recaptcha/docs/v3</ref><ref>https://antcpt.com/score_detector/</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>https://arxiv.org/pdf/1903.01003</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

	reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/</ref>		reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>

	*Degrade the user experience.		*Degrade the user experience.
Line 43:		Line 43:
	[[Category:CAPTCHA]]		[[Category:CAPTCHA]]
	[[Category:Google]]		[[Category:Google]]
	[[Category:Data ~~Collection]]~~		[[Category:Data collection]]
	~~[[Category:Articles in need of additional work~~]]

TasmanianRex at 03:14, 9 March 2025

2025-03-09T03:14:34Z

← Older revision		Revision as of 03:14, 9 March 2025
Line 21:		Line 21:
	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>https://trends.builtwith.com/widgets/captcha</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">https://arxiv.org/pdf/2311.10911</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Google has also been accused of allowing reCAPTCHA to accept users running [[Chromium]] web browsers more frequently than alternatives.{{Citation needed}} Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>https://news.ycombinator.com/item?id=20147015</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>https://trends.builtwith.com/widgets/captcha</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">https://arxiv.org/pdf/2311.10911</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Google has also been accused of allowing reCAPTCHA to accept users running [[Chromium]] web browsers more frequently than alternatives.{{Citation needed}} Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>https://news.ycombinator.com/item?id=20147015</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>https://www.popsci.com/google-invisible-recaptcha/</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>https://developers.google.com/recaptcha/docs/v3</ref><ref>https://antcpt.com/score_detector/</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>https://arxiv.org/pdf/1903.01003</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>https://www.popsci.com/google-invisible-recaptcha/</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>https://developers.google.com/recaptcha/docs/v3</ref><ref>https://antcpt.com/score_detector/</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>https://arxiv.org/pdf/1903.01003</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

	reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/</ref>		reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/</ref>

← Older revision		Revision as of 07:13, 23 February 2026
Line 24:		Line 24:
	This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>		This digital fingerprinting is nearly inescapable even for privacy focused consumers since, as of November 2024, reCAPTCHA is employed in 84% of all websites.<ref>{{Cite web \|title=CAPTCHA Usage Distribution in the Top 1 Million Sites \|url=https://trends.builtwith.com/widgets/captcha \|website=BuiltWith \|archive-url=http://web.archive.org/web/20251121124533/https://trends.builtwith.com/widgets/captcha \|archive-date=21 Nov 2025}}</ref><blockquote>"The implication is that Google isn’t just looking to identify whether you’re a human with its No CAPTCHA, but potentially exactly ''which human'' you are." - Lara O'Reilly<ref name=":0" /></blockquote>A 2023 study collected data on newly admitted students to UC Irvine's School of Information & Computer Sciences over 13 months and concludes that reCAPTCHA does not provide real security for Google's client websites and has, over its 13 years of existence, cost users an estimated 819 million hours equating to nearly $6 billion USD in wages and 134 petabytes of bandwidth corresponding to 7.5 million pounds of CO<sub>2</sub>. The study further estimated Google's direct profits from reCAPTCHA to be "$888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."<ref name=":1">{{Cite journal \|last=Searles \|first=Andrew \|last2=Prapty \|first2=Renascence Tarafder \|last3=Tsudik \|first3=Gene \|date=21 Nov 2023 \|title=Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 \|url=https://arxiv.org/pdf/2311.10911 \|journal=Preprint \|archive-url=http://web.archive.org/web/20260216085549/https://arxiv.org/pdf/2311.10911 \|archive-date=16 Feb 2026}}</ref><blockquote>"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for advertising profit masquerading as a security service." - Searles, Prapty, and Tsudik<ref name=":1" /></blockquote>Some commentators have alleged that reCAPTCHA’s risk scoring and challenge behavior can differ by browser, with Chrome/Chromium users sometimes reporting fewer challenges than users of other browsers.<ref>{{Cite web \|title=Google's reCAPTCHA test has been tricked by artificial intelligence \|website=The Register \|date=2019-06-28 \|url=https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/ \|access-date=2026-02-20}}</ref> Users of a Hacker News forum concluded that reCAPTCHA likely attributes a lower reputation score to users with privacy-focused applications and extensions running, thus [[Firefox]] users were assigned CAPTCHAs to solve at a higher rate and difficulty.<ref>{{Cite web \|last=kojoru \|date=10 Jun 2019 \|title=Google's Captcha in Firefox vs. in Chrome \|url=https://news.ycombinator.com/item?id=20147015 \|via=Y Combinator \|archive-url=http://web.archive.org/web/20250708234946/https://news.ycombinator.com/item?id=20147015 \|archive-date=8 Jul 2025}}</ref>

	reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>		reCAPTCHA v3, the "Invisible reCAPTCHA," launched in 2017 with the goal of never interrupting legitimate human users.<ref>{{Cite web \|last=Verger \|first=Rob \|date=11 Mar 2017 \|title=Google just made the internet a tiny bit less annoying \|url=https://www.popsci.com/google-invisible-recaptcha/ \|url-status=live \|archive-url=https://web.archive.org/web/20241123014232/https://www.popsci.com/google-invisible-recaptcha/ \|archive-date=23 Nov 2024 \|website=Populair Science}}</ref> This version works completely in the background using cookies to apply a reputation scored on a scale from 0.0 to 1.0, with the latter indicating high confidence a user is human.<ref>{{Cite web \|title=reCAPTCHA v3 \|url=https://developers.google.com/recaptcha/docs/v3 \|website=Google for Developers \|archive-url=http://web.archive.org/web/20260209114655/https://developers.google.com/recaptcha/docs/v3? \|archive-date=9 Feb 2026}}</ref><ref>{{Cite web \|title=reCAPTCHA v3 score detector \|url=https://antcpt.com/score_detector/ \|archive-url=http://web.archive.org/web/20260222200003/https://antcpt.com/score_detector/ \|archive-date=22 Feb 2026}}</ref> A 2019 study on hacking version 3 revealed that reCAPTCHA assigned low scores to simulated users using [[TOR browser]] and that browsers with an active Google account connected received higher scores as compared to browsers without a Google account connected.<ref>{{Cite journal \|last=Akrout \|first=Ismail \|last2=Feriani \|first2=Amal \|last3=Akrout \|first3=Mohamed \|date=18 Apr 2019 \|title=Hacking Google reCAPTCHA v3 using Reinforcement Learning \|url=https://arxiv.org/pdf/1903.01003 \|journal=Preprint \|archive-url=http://web.archive.org/web/20251112104945/https://arxiv.org/pdf/1903.01003 \|archive-date=12 Nov 2025}}</ref> Technology consultant Marcos Perona observed similar results and experienced low reputation scores when using a [[VPN]], too. Google recommends implementing reCAPTCHA v3 in the background of all client webpages, so that it collects user data prior to it needing to determine if the user is a bot.<ref name=":2">{{Cite web \|last=Schwab \|first=Katharine \|date=27 Jun 2019 \|title=Google’s new reCAPTCHA has a dark side \|url=https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|url-status=live \|archive-url=https://web.archive.org/web/20190627144558/https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side \|archive-date=27 Jun 2019 \|website=Fast Company}}</ref><blockquote>"Because reCaptcha v3 is likely to be on every page of a website, if you’re signed into your Google account there’s a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3—and there many be no visual indication on the site that it’s happening, beyond a small reCaptcha logo hidden in the corner" - Katharine Schwab<ref name=":2" />[[File:Invisible-reCaptcha-in-Corner.png\|thumb\|375px\|reCAPTCHA logo in corner of webpage indicating user's behaviors are being analyzed.]]</blockquote>

	reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>		reCAPTCHA's shortcomings as summarized by one of their direct competitors, DataDome:<ref>{{Cite web \|date=20 Aug 2022 \|title=ReCAPTCHA v2 vs. v3: Efficient bot protection? \|url=https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|url-status=live \|archive-url=https://web.archive.org/web/20240211073038/https://datadome.co/guides/captcha/recaptchav2-recaptchav3-efficient-bot-protection/ \|archive-date=11 Feb 2024 \|website=Data Dome}}</ref>