Skip to main content
Sticky

Switching Google’s role with reCAPTCHA from Data Controller to Data Processor

  • February 4, 2026
  • 5 replies
  • 896 views

Sheik
Staff
Forum|alt.badge.img+1

On April 2, 2026, reCAPTCHA will transition  from a Data Controller to a Data Processor, offering customers greater control over their users' personal data. With this switch, customers deploying reCAPTCHA on their websites will become data controllers,  while  Google will become a data processor. To learn more,  check out our blog.

 

 

5 replies

  • New Member
  • February 5, 2026

The reCAPTCHA widget has links to Google’s Privacy Policy and Terms of Service. Starting April 2, 2026, will those links go away automatically?


NEK
  • New Member
  • February 6, 2026

I'm so confused by the Google Cloud emails regarding reCAPTCHA. I have a Google My Business profile page, but am no longer using it to host my website. And as far as I know, I am no longer using the Google reCAPTCHA plugin on my NEK Editing website, unless my two Jotform forms are, which I don't have any control over how they work. Can someone please tell me if this plugin/app applies to me? If not, why am I getting these emails?


bobbieh
  • New Member
  • February 11, 2026

As a data controller from 2 April, we will need to meet our obligations for multiple GDPR articles.  Can you publish these please?

  • Categories of personal data processed by reCAPTCHA
  • Description of processing operations and purposes
  • Sub‑processors
  • Retention details
  • Explanation of profling or automated decision making

I couldn’t see these listed on the existing pages.


DeliaM
Forum|alt.badge.img
  • Bronze 1
  • March 1, 2026

Hi there, could you please confirm what timezone the rollout date is in? I’m based in New Zealand (NZDT), and I want to make sure I’m interpreting the date correctly


Privacy321
Forum|alt.badge.img
  • Bronze 1
  • March 10, 2026

Hi, Is Google able to give guidance on the language we should now use in our privacy policies as Data Controllers of the data individuals use for reCAPTCHA? I understand the removal of reference to Google for reCAPTCHA as you are no longer Data Controllers but what should customers/businesses now say in their privacy policy regarding reCAPTCHA and/or directly when they collect information for reCAPTCHA? Now that they will be Data Controllers their are GDPR requirements to meet. 
In addition to this how does the Controller to Processor relationship governed between business and Google?