Add new plugin Recaptcha3Token that sends the reCaptcha v3 token to the back-end when the form is valid

This form uses ReCaptcha. Before sending the form, please accept cookies before sending the form

The mix of a fingerprint and first-party cookies is pervasive as Google can give a very high level of entropy when it comes to distinguishing an individual person.

Google encouraging site admins to put reCaptcha all over their sites, and then sharing the resulting risk scores with those admins is great for security, Perona thinks, because he says it “gives site owners more control and visibility over what’s going on” with potential scammer and bot attacks, and the system will give admins more accurate scores than if reCaptcha is only using data from a single webpage to analyze user behavior. But there’s the trade-off. “It makes sense and makes it more user-friendly, but it also gives Google more data,”

For instance, Google’s reCaptcha cookie follows the same logic of the Facebook “like” button when it’s embedded in other websites—it gives that site some social media functionality, but it also lets Facebook know that you’re there.

Previously, Google has said that the data captured from reCaptcha is not used for ad targeting or analyzing user interests and preferences. After this story was published, Google said that the information collected through reCaptcha will not be used for personalized advertising by Google.

one of the ways that Google determines whether you’re a malicious user or not is whether you already have a Google cookie installed on your browser.

Website administrators then get access to their visitors’ risk scores and can decide how to handle them: For instance, if a user with a high risk score attempts to log in, the website can set rules to ask them to enter additional verification information through two-factor authentication. As Khormaee put it, the “worst case is we have a little inconvenience for legitimate users, but if there is an adversary, we prevent your account from being stolen.”

How "Invisible Captcha" Works Invisible Captcha, or reCAPTCHA, requires end-users to click a button that says "I'm not a robot" and Google can determine whether to prompt the user with additional question (i.e. select pictures that best describe X) to verify if that person is in fact not a robot.

And this is where we can all see dark clouds forming: if Recaptcha is opt-in (as the GDPR requires) then all a spammer needs to do to bypass Recaptcha, is to not accept cookies, right?

You definitely need an opt-in if you want to be GDPR compliant.

Google Recaptcha and personal dataBut we all know: there’s no such thing as a free lunch right? So what is the price we pay for this great feature? Right: it’s personal data.