Skip to content
CLOUD Act flagged on every listing
EU VETTED
Category

CAPTCHA & bot protection

In short CAPTCHA and bot-protection services decide whether a visitor is human before a form submits. Google reCAPTCHA is the default and is also the single most-flagged third-party script in EU cookie-consent audits, because it sets cookies and sends visitor data to Google LLC. The European options on EU Vetted are CaptchaFox (Germany), TrustCaptcha (Germany), ALTCHA (Czechia, MIT-licensed), captcha.eu (Austria), Friendly Captcha (Germany), mosparo (Switzerland, self-hosted), Prosopo (United Kingdom) and Botpoison. The distinction that matters here is between the widget path, meaning the chain your visitors' IP addresses actually travel through, and the vendor's own back office. CaptchaFox is the only vendor that names its widget-path processors publicly, and both of them are EU companies.
About this category
About CAPTCHA & bot protection

A CAPTCHA sits in front of your forms and decides whether the visitor is a person. To do that it has to look at them: IP address, browser and device characteristics, interaction timing. That makes it one of the few third-party scripts that runs for every visitor before they have agreed to anything, which is exactly why Google reCAPTCHA has become the most frequently flagged item in European cookie-consent audits, sitting next to Google Fonts on the list of things a DPA-conscious operator is told to remove. reCAPTCHA is operated by Google LLC, it sets cookies, and it puts a US processor in the path of every contact form on your site.

The European field is healthier than most people assume, and it splits along a line worth understanding before comparing prices. Some vendors are hosted services, where you are trusting somebody else's infrastructure: CaptchaFox and TrustCaptcha in Germany both run on Hetzner and keep the widget path inside the EU, captcha.eu is an Austrian product from inside the Kronen Zeitung publishing group, Friendly Captcha is the best-known German name, and Prosopo is a UK operator with unusually complete documentation. Others remove the question entirely: mosparo, from a Swiss non-profit association, and ALTCHA, MIT-licensed from Brno, can both run on your own infrastructure, at which point there is no processor to audit at all.

Two things are worth checking on every listing below, and neither is the company's flag. The first is the widget path, the chain your visitors' data actually travels through, as distinct from the vendor's billing and support stack; a vendor can be spotless on the first and use Stripe and Google on the second, and only one vendor here documents the difference. The second is whether the DPA is readable before you sign up: two of the eight publish one, two issue it on request, one has it behind a password, and two publish nothing. Accessibility is a third axis that has become a legal one, since the European Accessibility Act applies from June 2025 and a puzzle-based challenge is a barrier by design.

Showing all 8 alternatives in this category

Feature comparison

Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.

Feature mosparo ALTCHA captcha.eu CaptchaFox Prosopo TrustCaptcha Botpoison Friendly Captcha
Self-hostable Yes Yes No No No No No No
No cookies or browser storage Yes Yes Yes Yes
Invisible challenge Yes Yes Yes Yes Yes Yes Yes Yes
Proof-of-work Yes Yes Yes Yes
Bot risk scoring Yes Yes Yes
WCAG accessibility conformance Yes Yes Yes Yes Yes Yes
CMS plugins Yes Yes Yes Yes Yes Yes Yes Yes
Free tier Yes Yes No No Yes No Yes Yes
SWITCHING GUIDES

Switching from US captcha & bot protection?

Side-by-side European alternatives (same hosting, ownership and CLOUD Act checks) for the US tools most often replaced in this category.

FAQ

Frequently asked questions

What is the best GDPR-compliant alternative to reCAPTCHA?
For a hosted service, CaptchaFox (Germany) has the cleanest published chain: its widget-path sub-processors are Hetzner (Germany) and bunny.net (Slovenia), both named on a public page, and its exposure is recorded as Minor. TrustCaptcha (Germany) is the cheapest EU-hosted option at €8 per month on Hetzner in Nuremberg, exposure Minor. If you can self-host, ALTCHA and mosparo remove the vendor from the data path entirely, which is stronger than any hosted promise.
Does using reCAPTCHA require a cookie banner?
In practice, yes. reCAPTCHA sets cookies and transmits visitor data to Google, so it is not a strictly necessary cookie in the sense that gets you out of the consent requirement, and it is routinely listed in the marketing or analytics category of consent tools. Cookie-free CAPTCHAs avoid the problem structurally: several vendors here set no cookies and write nothing persistent to the browser, so the form can be protected on a legitimate-interest basis under Art. 6(1)(f) instead of waiting for consent.
Which of these vendors publishes a DPA?
Only two: ALTCHA publishes a downloadable DPA PDF, and Prosopo publishes one as a readable page with its sub-processor list inside it. CaptchaFox and TrustCaptcha state that a DPA is included on every plan but issue it on request. Friendly Captcha's DPA URL is password-protected. captcha.eu and Botpoison publish none. mosparo needs none, because it is self-hosted and the association never processes your data.
What is the difference between the widget path and the rest of a vendor's stack?
The widget path is the chain a visitor's IP address and browser signals actually pass through when a form is protected. Everything else, billing, support ticketing, the vendor's own website analytics, touches your account data rather than your visitors. The distinction matters because a vendor can be entirely EU on the widget path and still use Stripe or Google in the back office. CaptchaFox is the only vendor here that separates the two publicly, listing Hetzner and bunny.net for the widget and Simple Analytics and Stripe for the service side.
Is a CAPTCHA an accessibility problem?
Traditional image and audio CAPTCHAs are, and since June 2025 the European Accessibility Act makes that a compliance question rather than a courtesy for many operators. Proof-of-work and invisible challenges avoid it by never asking the visitor to do anything: ALTCHA is built to WCAG 2.2 AA and EAA conformance, TrustCaptcha and Prosopo document accessibility, and Friendly Captcha claims WCAG 2.2 AA certified by TÜV, though without publishing a report or audit date.
Can I self-host bot protection instead of buying a service?
Yes, and it is the strongest posture in this category. mosparo (MIT, Swiss association) is self-hosted only and analyses form content on your own server, so no third party ever sees a visitor. ALTCHA (MIT) can be self-hosted as widget plus verification server, or bought as a managed Cloud tier. In both cases you take on operations, updates and security patching in exchange for having no processor chain at all.
Are the European CAPTCHA vendors themselves hosted in Europe?
Not all of them, and this is the finding of the category. CaptchaFox runs on Hetzner and bunny.net, TrustCaptcha on Hetzner in Nuremberg, both entirely EU. ALTCHA Cloud runs on AWS with an EU-only residency commitment. captcha.eu, despite the domain name, is served from Amazon S3 behind CloudFront with Microsoft 365 mail and Google ad measurement. Prosopo names AWS, Cloudflare and Hostwinds alongside Hetzner, Contabo, OVHcloud and bunny.net. Botpoison names AWS, Google Analytics, Sentry and Stripe. Check the hosting row on each listing rather than the flag on the logo.