InfoPeak Captcha: A GDPR-Secure Alternative to reCAPTCHA

Every "I am not a robot" checkbox on the internet quietly enrolls your site in someone elses data pipeline. reCAPTCHA does not just stop bots. It profiles the human clicking it, ties the click to a Google account or fingerprint, and moves that signal to US infrastructure - which is why so many European sites now show a cookie banner just to protect a contact form. That is not a security feature. It is a data processing agreement wearing a checkbox. InfoPeak Captcha is what a CAPTCHA looks like when it is built to stop bots and nothing else.

The checkbox that comes with a data processing agreement

reCAPTCHA v3 does not show most visitors a puzzle at all. It runs continuously in the background, scoring behavior across the sites that embed it - mouse movement, timing, browsing history tied to a Google account or device fingerprint. The bot detection is real. So is the profiling underneath it. Several EU data protection authorities and courts have flagged this exact pattern: a widget that transfers visitor data to US servers, subject to US law, embedded on a page with no consent flow of its own. The result is familiar to anyone who has built a website in Europe recently - a cookie banner whose only job is to ask permission for a security checkbox.

That is the trade most site owners never actually agreed to. You wanted to stop spam. You got a tracker.

Switching badges does not switch jurisdiction

The usual advice is to swap reCAPTCHA for hCaptcha or Cloudflare Turnstile. Both are technically capable, and both are still companies operating under US law, reachable by the same legal mechanisms that make reCAPTCHA a liability in the first place. Changing the badge on your form does not change who can be compelled to hand over what it sees. Jurisdiction is not a design detail you patch with a different vendor - it is the actual problem, and it survives every provider swap that stays inside the same legal system.

What InfoPeak Captcha does instead

InfoPeak Captcha proves a visitor is not a bot with proof-of-work instead of profiling - the same principle behind spam-resistant email systems, adapted for the browser. The visitor solves a small, invisible computational puzzle. A bot farm running thousands of requests per second pays a real computational cost for every one of them. A human clicking a form once does not notice the delay. No images to click, no behavioral score, no personal data collected at all.

• EU-owned and EU-run infrastructure: the service is built and operated in Europe, under European law, not routed through infrastructure a foreign jurisdiction can reach on request.
• No tracking, no cookies, no consent banner required: nothing is fingerprinted and nothing is stored about the visitor beyond the single-use challenge needed to verify the work.
• Domain-bound sitekeys: each key can be locked to the domains that are allowed to use it, closing off the key theft that plagues badge-based widgets.
• Adaptive difficulty: the computational challenge scales automatically under bot pressure, so real visitors barely notice while automated traffic pays an increasing cost.

GDPR compliance is not a policy layered on top. It is what happens when there is no personal data collected to begin with - the least dangerous data a widget can hold is the data it never asks for.

We use it on our own forms

InfoPeak Captcha protects InfoPeaks own contact and sales forms, the free and Professional trial signup flows, and login after repeated failed attempts - the same product our customers embed, running on the same pages we ask visitors to trust. If a security product is not confident enough to run on its own makers site, it is not ready to run on yours. Look for the small "Protected by InfoPeak" badge the next time you fill out a form on infopeak.io.

Who this is for

A CAPTCHA is not a suite feature gated behind a plan - it is infrastructure any site owner needs, at any scale:

• Solo builders and personal sites: the free tier covers a personal blog, portfolio, or side project comment form without a credit card. See what fits your setup on InfoPeak Personal.
• Family projects and small community sites: a shared family blog or a local club signup page gets the same GDPR-safe protection without a separate vendor relationship. More on InfoPeak Family.
• Professional and business teams: production signup flows, checkout forms, and support portals scale to Pro and Business tiers with higher limits and domain binding built in. See InfoPeak Professional.

Questions people ask before switching from reCAPTCHA

Is InfoPeak Captcha free to use?

Yes. The free tier covers up to 10,000 verifications a month, enough for most personal sites and small projects. Paid tiers scale up for higher-traffic and business use.

Does InfoPeak Captcha require a cookie consent banner?

No. Because nothing is tracked, fingerprinted, or stored beyond the single-use verification challenge, there is no personal data being processed that would trigger a consent requirement.

How is proof-of-work different from an image challenge?

An image challenge asks the visitor to prove they are human by solving a puzzle designed for people. Proof-of-work asks the visitor browser to complete a small computation that is cheap for one request and expensive at bot-farm scale, so most real visitors never see anything beyond a brief loading state.

Can I use InfoPeak Captcha without the rest of the InfoPeak suite?

Almost. Getting a sitekey requires a free InfoPeak account, but Captcha itself is billed and used independently from there - you do not need to activate Mail, Drive, or any other part of the suite. Sign up free and a sitekey is minutes away.

A security widget should not need a privacy policy of its own

The industry treats surveillance as an acceptable side effect of bot protection - a tax you pay for a working contact form. It is not a law of nature. It is a design choice, and a lazy one. InfoPeak Captcha proves the checkbox and the tracker were never actually the same thing. That is the standard we think every security widget should be held to, starting with our own.