I work on hCaptcha -- we pay websites for providing data labeling via our captcha. We also provide a mechanism to accept privacypass as a bypass. There are thr

I work on hCaptcha -- we pay websites for providing data labeling via our captcha. We also provide a mechanism to accept privacypass as a bypass. There are three major categories of bots: 1) a combinatoric attack hoping to get lucky with an answer 2) employ some amount of smarts to fool the captcha (fetching lots of images without answering anything until they are sure of the answer, replay attacks to mimic human behavior, perceptual hashing of images etc) 3) Anti-Captcha (using people to solve captchas). We can mostly recognize the first two kinds of attacks, but it is very difficult to stop the anti-captcha humans -- especially without tracking as many features as possible. One of the chief issues with most captchas is that they do not provide epidemic analysis and a webhook/endpoint to inform sites about a user after the initial sign-up. This also requires some amount of user tracking to recognize malicious behavior and retroactively tag and act upon it. Monetizing human activity can somewhat offset costs associated with dealing with these networks of bad accounts later and using privacypass gives the user a mechanism to bypass tracking their activity while also pricing out malicious account signup using anti-captcha. A privacy-respecting captcha used for monetization also opens up an entirely different opportunity for publishers, offering a lower friction experience for users who want to support online content without privacy invasive advertisements and paywalls.