European alternatives to Google reCAPTCHA.

Google reCAPTCHA is on a very large share of the world's contact forms, and for a European operator it is an awkward thing to have there. It is run by Google LLC, it sets cookies, and it inspects every visitor's IP address, browser characteristics and interaction timing before they have agreed to anything. In consent tooling it lands in the marketing or analytics bucket rather than the strictly-necessary one, which means it needs a banner entry, and a form protected by a script the visitor declined is a form that does not work. Alongside Google Fonts it is the item most often flagged when someone audits a German or Austrian site, and the accessibility of image challenges has become its own exposure since the European Accessibility Act started applying in June 2025.

The good news is that this is one of the cheapest swaps in the whole directory. Every option below has the same integration shape as reCAPTCHA, a script plus a server-side token check, so the work is measured in hours rather than sprints. CaptchaFox (Germany, exposure Minor) is the strongest hosted pick because it is the only vendor here that publishes its widget-path sub-processors by name, and both are EU companies. TrustCaptcha (Germany, exposure Minor) is the cheapest EU-hosted entry, on Hetzner in Nuremberg from €8 per month. ALTCHA (Czechia, MIT, exposure Material) and mosparo (Swiss association, MIT, exposure None) can be self-hosted, which removes the processor question entirely. captcha.eu (Austria, exposure Material), Friendly Captcha (Germany) and Prosopo (UK, exposure Material) complete the field.

One caution before the comparison, because it is the finding of this category: a European logo does not mean a European stack. Check each listing's hosting row and sub-processor table rather than the flag, because several of the vendors selling escape from Google are themselves on AWS, CloudFront or Google analytics.

So what carries over from reCAPTCHA?

• The integration shape: a script, a widget element, a site key and a server-side verification call.
• Invisible or low-friction verification, offered by every option here.
• Score-style bot signals for your own logic (CaptchaFox, TrustCaptcha, Prosopo).
• WordPress and CMS plugins, plus React and Angular components.
• Allow and block lists, geoblocking and custom rules on the paid tiers.
• Better accessibility than image challenges, since none of these asks the visitor to identify anything.

Not everything makes the trip, though:

• Google's traffic graph. reCAPTCHA scores a visitor against signals from an enormous share of the web. No European vendor has that dataset, and honest ones do not claim to. For ordinary form spam this is not the constraint people expect it to be; for large-scale credential stuffing, evaluate carefully.
• Enterprise fraud tooling. reCAPTCHA Enterprise's account-defender and multi-factor risk features have no direct equivalent here; Prosopo covers the widest slice of that ground.
• Being free at any scale. reCAPTCHA is free for most users. Here, free means a small tier (Prosopo, Botpoison) or self-hosting your own server (mosparo, ALTCHA).
• Mobile SDKs. Native iOS and Android SDK coverage is thinner across this field than Google's; check per vendor if you protect a mobile app rather than a web form.

Replacing reCAPTCHA is mostly a search-and-replace exercise, with two steps people forget.

1. Inventory every form first. Grep the codebase for the reCAPTCHA site key, then check WordPress plugins, contact-form builders, help-desk widgets, landing pages built by marketing, and any mobile client. The swap is easy; the forgotten third-party form is what leaves a Google script on the site after you have announced you removed it.
2. Swap the client and the server together. Replace the script tag and widget element, then re-point the server-side verification call from www.google.com/recaptcha/api/siteverify to your new vendor's verify endpoint and update the token field name. Keep both paths behind a feature flag for one deploy if the form is high-traffic.
3. Rotate keys and remove the old ones. Delete the reCAPTCHA keys from your Google account once traffic has moved, and take the secret out of the environment files and CI variables rather than leaving it to rot.
4. Take reCAPTCHA out of the consent banner and privacy policy. This is the step that produces the actual compliance benefit, and it gets skipped. Remove the reCAPTCHA entry from your consent tool, delete the Google paragraph from your privacy notice, and add a short section naming the new processor. If the new widget is cookie-free, the form can now run without consent, so also remove any consent-gating you had wrapped around it.
5. Retest accessibility, not just function. Run the form with a keyboard only and with a screen reader. This is the moment to check that you did not swap one barrier for another, and under the European Accessibility Act it is worth documenting that you checked.
6. Watch the spam rate for two weeks. Tune the difficulty or risk threshold rather than concluding after two days. Most vendors here expose a sensitivity setting, and the default is deliberately conservative.