CAPTCHAs and privacy
This page is for project managers, administrators and data protection officers. Two optional extensions add a CAPTCHA
datatype to forms: recaptcha (Google reCAPTCHA, v2, with a v3 template for the feedback form) and hcaptcha
(recaptcha, hcaptcha).
Both load a script from the provider, so the visitor's browser talks to a third party.
Note This page describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel.
Contents
How they work
- Activate the extension; put your keys in
settings/override/recaptcha.ini.append.phporhcaptcha.ini.append.php(keep the secret out of version control). - Add the CAPTCHA attribute to a class: a contact form class, or the user class for registration.
- The form shows the provider's widget; the server checks the answer with the provider before accepting the form.
[PublishSettings] NewObjectsOnly=true checks only new objects (registration yes, profile edits no)
(Spam protection for forms).
Privacy implications
- The project's statement: consent or notice is needed "in most readings of art. 5(3)"; mention the provider in your privacy notice (Privacy standards).
- The provider receives browser and interaction data of every visitor who opens a protected form, including people contacting a public body about personal matters.
- Under a Content Security Policy the provider's hosts must be allowed on that siteaccess.
Accessibility
CAPTCHAs are a known barrier for people with visual, cognitive or motor impairments. If you use one, test it with the keyboard and a screen reader, and offer another contact route (e-mail, phone) next to the form. The accessibility section of this help covers forms.
Deciding
| Option | Privacy | Accessibility | Spam protection |
|---|---|---|---|
Form token only (ezformtoken, active by default) | nothing leaves the site | no barrier | stops forged cross-site posts, not determined bots |
| Form token plus your own server-side checks | nothing leaves the site | no barrier | moderate |
| request-shield in front, with its browser check for form pages | nothing leaves the site (part of the default installation since 6.0.15) | invisible check | good against floods |
| hCaptcha or reCAPTCHA | third party | possible barrier | strong |
Start with the options that keep data on your site; add a CAPTCHA only on forms with real abuse.
Related pages
- Spam protection for forms
- Third-party extensions and privacy
- Cookie banners and consent
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.