Google ReCAPTCHA Changes Terms of Use For 2026: What You Need to Know

At the end of 2025, Google changed the reCAPTCHA Terms of Use and migrated all existing “Classic” reCAPTCHA keys to the Google Cloud platform. This transition moves all reCAPTCHA users under the unified Google Cloud Terms of Service and a new pricing structure.

The previous unlimited free tier for “Classic” reCAPTCHA keys is no longer available. With the Google Cloud Platform, the new free tier is capped at 10,000 assessments per month. Usage above this limit will incur charges through a linked Google Cloud billing account. This means that as a website owner, you’ll need to add a credit card to the associated Google Cloud account to continue using reCAPTCHA (any version). Also, when it comes to when your website might hit the 10,000 free assessments (form visits) limit per month, keep in mind that more than half of all website traffic is comprised of bot traffic. That means that if your forms pages receive 5,000 human visits per month, you are likely to get more than 5,000 bot visits, which would cause your site to exceed the maximum visits allowed under reCAPTCHA’s free tier. If you exceed the limit and don’t have a credit card on file, the Google reCAPTCHA module will reportedly stop working until the next billing month. That means visitors to your site wouldn’t be able to submit a form (at least until the next billing month), resulting in lost sales or leads.

Why is CAPTCHA Needed?

Simply stated, the goal for all types of CAPTCHA modules is to stop malicious bots from spamming your contact forms, creating fake accounts, stealing data, using your checkout page to test stolen credit cards, or launching attacks such as brute-force login attempts. For almost two decades, Google reCAPTCHA was the best available open-source solution. Using reCAPTCHA was free, most users were familiar with it, and the integration was straightforward and fast.

However, reCAPTCHA has never been a great experience, often requiring users to solve frustrating puzzles, like retyping letters and numbers seen in an image (reCAPTCHA v1), or to select all boxes that show a specific item, such as crosswalks, bicycles, buses, stairs, bridges, etc. (reCAPTCHA v2).

Admittedly, reCAPTCHA v3 is better. It’s designed to be invisible. There is no “I’m not a robot” checkbox or image puzzles to solve. Instead, it operates entirely in the background, continuously monitoring user behavior and interactions to assess the likelihood of a user being a bot. However, some users who use their browser’s incognito mode, a VPN, or privacy-focused browsers may run into issues. Sometimes, reCAPTCHA v3 flags these users as “suspicious” and forces them to solve frustrating image challenges.

There’s another reason why reCAPTCHA may not be the best solution going forward. reCAPTCHA collects vast amounts of user data, including IP addresses, browser information, and behavior patterns (mouse movements, time spent on page), which raises major red flags for privacy and compliance with regulations like GDPR and CCPA. Also, the Google reCAPTCHA script is heavier than other options and can slow down page load times.

A Better Option: Cloudflare Turnstile

Cloudflare, the global cloud services and cybersecurity company, offers many services to filter and accelerate traffic—namely a Content Delivery Network (CDN), DDoS mitigation, and DNS management. Cloudflare also delivers an alternative to Google reCAPTCHA—Cloudflare Turnstile. You’ve seen Turnstile before. It usually doesn’t even require the user to click the checkbox (see it in action below).

Cloudflare says Turnstile is designed to confirm web visitors are real and block unwanted bots without slowing down web experiences for real users. It also excels in privacy protection. Turnstile is built with data minimization in mind, does not use cookies for tracking, avoids cross-site tracking, and is explicitly designed to be GDPR compliant.

At Saltworks, we believe Turnstile offers a better performance, better privacy protections, and a frictionless user experience. This is why we’re recommending that our clients make the switch to Cloudflare Turnstile.

Turnstile is currently available with all Cloudflare accounts, even the free option. However, to take full advantage of more advanced Cloudflare features, you might consider a paid account (The Pro option is $20/month for an annual plan).

Note that sites using reCAPTCHA without a payment method (credit card) added to the accompanying Google Cloud account may experience interruptions in reCAPTCHA service if the visits to the contact pages or Checkout page exceed Google’s quota for free service.

If your website is currently using Google reCAPTCHA and you would like Saltworks to help you make the switch to Cloudflare Turnstile, or if you want to keep using Google reCAPTCHA and you need help correctly setting up the billing account in Google Cloud and checking your reCAPTCHA keys, reach out to us. We’d love to help.