Google's Recaptchas Also Capture Your Private Information

CAPTCHAs are great for security, but terrible for your privacy.

Interesting fact: you actually rarely encounter an original CAPTCHA. They've largely been supplanted by reCAPTCHAs, a system owned by search engine giant, Google. And in an effort to stop spambots, reCAPTCHAs have evolved so much, they're now a threat to your privacy.

What Are reCAPTCHAs?

A Completely Automated Public Turing Test to Tell Computers and Humans Apart (CAPTCHA) was a useful tool in stopping bots from spamming forms. Traditional CAPTCHAs skewed text in an effort to make it unreadable for malicious software. Humans could decipher it, however, so these acted as filters.

Spambots got smarter. CAPTCHAs had to evolve. They changed into reCAPTCHAs, developed by the same team who originally came up with the tests. Google acquired the project in 2009. This raised some eyebrows because many users are doubtful of its intentions.

ReCAPTCHAs were nonetheless used for great effect. They advanced machine learning. Instead of random letters, a reCAPTCHA comprised of words Google's bots couldn't decipher. Knowledge gained from these upgraded tests meant automated digitization of much classic literature for its Google Books service.

Then algorithms overtook humans. ReCAPTCHAs became redundant. Which is why Google introduced NoCAPTCHA reCAPTCHA.

What Is NoCAPTCHA reCAPTCHA?

Have you ever clicked on the "I'm not a robot" button and been approved without having to insert any additional information? That's because the site uses reCAPTCHA v2 or later.

With its second version, Google introduced verification based on other metrics---namely, if the user's other activities on the site are indicative of a human or bot. CAPTCHAs are only presented if that fails.

Then along came reCAPTCHAs v3. This update eliminated the "I'm not a robot" checkbox. It's also designed to streamline the process, so the user experience is a much nicer one.

This uses the same foundation as version 2, in that it assesses activity across the site. It goes further than that, though, by digging deeper into your online movements.

It further cuts the risk of CAPTCHA farmers (people employed to break traditional CAPTCHAs) making it through the security measure. With v3, their task would essentially be to guess how normal users interact with the site; but due to v3's wider scope, a more comprehensive online profile must be in place too.

4.5 million sites use reCAPTCHA already (including a quarter of the top-ranking 10,000). More than 650,000 of these have reCAPTCHA v3 installed.

You'll find different versions of reCAPTCHAs across the internet because website admins could still use outdated plug-ins. ReCAPTCHAs v1 (basic CAPTCHAs) are bad for a site's security, but better for your privacy.