32 ms·

Is Google reCAPTCHA GDPR Compliant?

143 points by openplatypus 3y ago

nness 3y ago
The article title is "Is Google reCAPTCHA GDPR Compliant?" And its a good point — broad data collection has always attracted the mire of European regulators, and in the decision they state that they find that reCaptcha serves as both a security and analytics tool (due to its broad data capture.) I can't argue with that definition. The solution, for Google, is to only conduct telemetry after the user has authorised that telemetry, allowing reCaptcha to function without the data collection consent. They already have such functionality in Google Analytics, but arguably, might be less valuable for Google without that data. For the businesses using reCaptcha, its a problem. The article makes a fair point that you can't use the service if the user declines consent. But it is a reminder that any business operating in the EU at this scale must incorporate a data privacy specialist into their requirements gathering and review processes. It's just the price of the ticket to play in the EU.
- miohtama 3y ago
  You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. Thus, no special consent is needed. The different question is that if Google uses this data for purposes it is not intended. In this case the service might be still GDPR compliant from the website implementor point of view, but Google would be doing fraud by breaking their Terms of Service how the data is handled.
  - croes 3y ago
    If a service doesn't work without respecting user rights, the service can't be used. What's next? Capture a picture of your webcam to check if a real person is sitting in front of the PC?
    - mozman 3y ago
      This is already happening, with some remote working platforms requiring the camera on during working hours Twitter also requires the employee to be in a dedicated room with a door that closes. At least they used to.
    - manmal 3y ago
      Some KYC processes in the EU (and likely elsewhere) do involve a webcam interview with a 3rd party who checks the customer‘s face and passport.
  - krzyk 3y ago
    The question is also, why separate humans from bots? It makes creating useful scripts harder, doesn't it fall into "fair use" case which in EU is enforced even in software where you can modify it to be able to run it on your platform.
    - dageshi 3y ago
      To prevent or at least cut down on spam? Pretty much the entire reason captcha systems were created in the first place and an entirely legitimate reason?
      - fkyoureadthedoc 3y ago
        In addition to spam, preventing bots from buying up all the GPUs and PS5s in the recent past would have been nice.
        pph 3y ago
        Though in the end you're the one clicking busses and bikes and bridges and busses again and when you're through that charade, everything is gone anyway because the bots were faster/better at that..
    - miohtama 3y ago
      It is up to the website owner to decide how they want to distribute the content, not the reader. What you see as fair is often not fair from the website owner point of view. If you disagree with this you are always free to create a competing business without such captcha limitations for bots, and put your money where your mouth is.
    - mozman 3y ago
      Think about why the bots exist - it's almost always data theft or other schemes to abuse your API to profit. Taking money from your pocket.
  - rypskar 3y ago
    >>because it is needed in order to perform the core function to separate bots from humans The core function for most sites using recaptcha is not to separate bots from humans, so a consent is needed before sending data to a 3rd party not related to the core functions of the site or app
  - jeroenhd 3y ago
    This does seem like a good legitimate use case. However, if Google transfers the data collected to its American servers or daughter companies, that would still make for a massive GDPR violation, both for Google for breaking the law and, if the situation does not get resolved, possibly for the companies using Google's services while it knowingly violates the law.
  - cassianoleal 3y ago
    > You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. You would have a hard time arguing that. The core function to separate bots from humans is done by requiring the user to identify certain images. The only data that needs to be "collected" (and even that doesn't need to be kept) is whether they clicked the correct squares.
    - jefftk 3y ago
      That is not most of how it identifies bot traffic. The order you click them, how quickly you click, and where within each square you click for all ways humans and computers can be different. But the real work is not about your interaction at all: this is how the invisible version can perform almost as well as the one where you click things. This involves comparing information about your computer's JavaScript environment with what they have seen elsewhere, and if you are running a bot farm it's pretty hard to keep your statistical distribution for all of these different attributes from looking odd.
      - cassianoleal 3y ago
        > how the invisible version can perform almost as well as the one where you click things I don't think it does for me. I run most websites in temporary containers, I do a lot of tracker blocking on DNS, uBo, etc., I clean cookies frequently. Either those CAPTCHAs are really bad and are considering me human when they shouldn't, or all those things you mentioned are not necessary for their core functionality.
        jefftk 3y ago
        Several of the non-interactive signals would still pass through in those sorts of situations. I don't know exactly what reCAPTCHA collects, but if you look at something like https://amiunique.org/fingerprint https://amiunique.org/fingerprint you can get a similar idea of what's possible.
        3y ago
- hnbad 3y ago
  > But it is a reminder that any business operating in the EU at this scale must incorporate a data privacy specialist into their requirements gathering and review processes. It's just the price of the ticket to play in the EU. This sounds very American. You don't need a data privacy specialist to operate in the EU. You need to develop with privacy first by design. Treat all PII as radioactive. Literally. Yes, if you need to bolt this onto existing US software to make it "compliant", you're screwed and you'll need to call in a containment team like when you find radioactive cargo in your business that is not normally expected to handle it. A lot of times topics like GDPR and privacy are brought up on HN I'm seeing comments that act like it's black magic. It really isn't. It's trivial to be "good enough" as far as legislation is concerned. The problem is just that over the past decades and especially in the US we've seen myriads of online services sprout up that now often seem integral but were built with a complete disregard for privacy and now need to either be retrofitted or somehow contained to become compliant. It's like finding out paint is radioactive after it has been marketed for decades with no regulation or oversight. Internet companies have been playing it fast and loose with privacy well past the point that people started pointing out it's a (ethical if not legal yet) problem. That is now coming back to bite them. I'm okay with that. It's just a shame so many businesses are caught in the crossfire because those companies have also tried their best to make themselves integral and unavoidable. Good luck trying to migrate away from AWS/Azure/GCP for example.
  - mbork_pl 3y ago
    > It's trivial to be "good enough" as far as legislation is concerned. I'd be very interested to read any tutorials/howtos/faqs/etc. about that. I might be tempted to create a (very small) side SaaS-type project (and I'm located in Europe), and the main reason I haven't done it yet is that GDPR compliance looks really, really scary to me.
  - mozman 3y ago
    Being compliant with regulations such as the GDPR is expensive. Lawyers, security, and annual third party testing. I don't profit off EU users so I block all non-USA traffic and avoid the issue entirely.
- jdietrich 3y ago
  It's almost certainly possible to defend the use of a reCAPTCHA-like tool without user consent under article 6 para 1(f) (legitimate interests). My concern with using reCAPTCHA would be the track record of Google - they have a long history of testing the boundaries of data protection law and accepting fines as a cost of doing business. Google don't appear to even mention GDPR in the marketing materials or docs for reCAPTCHA; they do claim that reCAPTCHA Enterprise (a separate, paid-for product) can be GDPR compliant, but I'd take that with a big pinch of salt. Competing CAPCHA services make much stronger claims regarding GDPR compliance and are much more transparent about how the service uses personal information.
sylware 3y ago
It is a grey/not well known area: as far as I know it is not working with noscript/basic (x)html browsers, which is paramount for past/present/future interoperability between big tech and small tech.
matusp 3y ago
This is the problem with the catch-all EU regulation. They needlessly create regulations that are so vague and broad that even completely bening activities are prohibited and you need your own law department to understand what exactly is required. Can't wait for the yet another button-clicking exercise when you will have to accept all the ToS of reCAPTCHA. Similar situation happening in the AI regulations. They are not sure what AI is or what it can do wrong, so they just slap a bunch of red tape on top of it and call it a day.
- raverbashing 3y ago
  "fully benign" yes I'm sure Google is providing the service for free and not relying on the data it collects... Though you're right that captcha/fonts etc should have been benign uses, if it could be anonymized/proxied then maybe that would have been a good solution.
  - deleted 3y ago
    [deleted]
- croes 3y ago
  Stop tracking people and you need no consent and banner. BTW the sides could simply respect the Do-Not-Track flag but somehow they prefer to annoy their users, just like it's on purpose to blame privacy laws.
  - matusp 3y ago
    I see no mention of reCAPTCHA tracking users. They are "sending data about device and application data", which seems like a completely natural thing considering what reCAPTCHA is used for.
    - croes 3y ago
      Since the reCAPTCHA code is loaded from the google.com domain, among others, the tool automatically gains access to cookies that are set for logged-in Google users. One of the cookies is called NID and contains a unique user ID that is also used for Google Signals to recognize users even across devices. In this respect, it is almost irrelevant from a data protection perspective whether reCAPTCHA (situationally) sets further cookies or not. In addition, reCAPTCHA also accesses the domain gstatic.com. As can be read on Google websites, this domain is also used by other tools. Thus, cookies can potentially be exchanged via this domain.
phoronixrly 3y ago
We've assumed this for a while now. We've stopped using reCAPTCHA together with all other services that may be sending our users' data outside of EU. As a developer, personally I am very happy with this decision, and am thankful that the GDPR is finally making management take user privacy into account.
dbbk 3y ago
This is taking the piss now
- draw_down 3y ago
  [dead]
Lornedon 3y ago
> We’re using “cookies” as a shorthand for any technologies that can access or store information on a person’s device. This can also include beacons, pixels, scripts, and other technologies. That is a weird use of the word "cookie". In normal usage, it doesn't mean a technology that accesses or stores the information, it is that information itself. "Pixels" is also weird. I think that they mean tracking pixels, which are one-pixel images that are just there so that the browser has to request them from the server and the server can notice that request. They are a subclass of "Beacons". Calling them a "technology that can access or store information on a person's device" seems misleading. Also, reCaptcha wouldn't need them. They already have Javascript running on my PC, they don't need a tracking pixel to contact the server.
- Akronymus 3y ago
  Pixels likely refers to 1x1 tracking images (image fetched from a server, and through that, they can get some data from you, like IP address or visited before)
  - Lornedon 3y ago
    Sorry, I sent my comment before it was done. It's edited now.
    - Akronymus 3y ago
      Yeah, I see your edit. With JS you can also detect whether it was fetched before, so that is a way of storing information about whether you have visited something before. Which can then be sent to the server. So, it kinda is storing data, kinda not.
- smeagull 3y ago
  In the end, you just use the cookie to store a unique id, and store everything on the server.
- ahoka 3y ago
  Cookies mean exactly that. You are just being overly pedantic. And yes, running JS in a users browser to store or access information is exactly the same. Taking a browser fingerprint and storing it server side is also the same, just harder to get caught doing. This whole trying to maliciously take these laws literally need to stop.
sam0x17 3y ago
captchas aren't going to be effective for much longer anyway with the recent dramatic improvements in AI
- dawnerd 3y ago
  Honestly captchas haven’t been effective for a while. They’ve been pretty trivial to bypass.
  - mozman 3y ago
    It may be trivial but costs money at scale - which is the entire point of PoW.
- manmal 3y ago
  Maybe proof of work based captchas will be a viable alternative, like https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha: > mCaptcha makes interacting with websites (computationally) expensive for the user. A well-behaving user will experience a slight delay (no delay when under moderate load to 2s when under attack; PoW difficulty is variable) but if someone wants to hammer your site, they will have to do more work to send requests than your server will have to do to respond to their request.
  - sam0x17 3y ago
    Proof of annoyance
  - slondr 3y ago
    So, banning low-compute-capacity clients in the worst way possible. Awesome.
    - ahoka 3y ago
      If you want to register to my site from your smart thermometer, then it’s your problem.
JacobSeated 3y ago
Well, it is also unnecessary, as simple OSS solutions exist. Users however tend to be greatly annoyed and inconvenienced by reCAPTCHA, which has grown increasingly difficult to decipher for real users. It is basically insulting to present real users with a CAPTCHA.
jwr 3y ago
CAPTCHAs are overused because of groupthink and fashions/fads. Before you use a CAPTCHA of any kind, consider very carefully if you really need one. I've seen this a number of times in design meetings: someone will say "oh, an account registration form, we will of course need a CAPTCHA there", everyone will nod their heads and move on. In reality, in most of those cases, no one will ever conceivably even try to automate/script the thing being designed.
- smeagull 3y ago
  Spam is ever present, and Captchas protect from the massive torrent of trash.
- Zardoz84 3y ago
  i had to put a CAPTCHA system on a public register form for digital libraries, because they were getting spammed by bots.
- efields 3y ago
  We ignored them until we needed them. Then we needed them.
- danuker 3y ago
  > no one will ever conceivably even try to automate/script the thing being designed. Spammers will spam everywhere they can. My minuscule personal site suffers from it very rarely, but I can imagine anyone getting a lot of page views making it worth it.
  - yonixw 3y ago
    On my custom built site I have none of those. But, on my WordPress site, I had to install captcha the second days. Spammers are just using scripts, which cost next to nothing...
    - eli 3y ago
      If a site gets even a little popular it attracts spam and security scanners and other nonsense no matter how it's built.
londons_explore 3y ago
Note that reCAPTCHA's use of hashing and encryption might mean that the private data this article refers to, such as device type, is not actually sent to google. A quick check with the network inspector doesn't obviously show this data being sent. And obviously to punish a company, the EU would need to prove this data is sent - a hard thing to do when the code of recaptcha is deliberately designed to prevent reverse engineering and analysis.
- jeroenhd 3y ago
  My French isn't exactly great but based on the machine translation of the linked court case, I believe the problem with reCAPTCHA is that Google uses it for more than just authenticating users. The generated fingerprint for these scripts is personal data, it pretty much directly refers to you as a person, that's the intention of the system. That's not necessarily a problem, though. These types of detection algorithms are perfectly allowed without explicit consent, just like other types of fraud and abuse detection.
TekMol 3y ago
The mistake here in Europe is that an ip address is considered personal information: https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-google-web-fonts-ist-dsgvo/ https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-g... This makes it impossible to use any components hosted by third parties without getting consent by the users. And for components hosted in a different country than the visitor, even consent might not make using those external components legal. This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider. So in Europe, the whole internet is made illegal based on a wrong assumption.
- jdsnape 3y ago
  That is not quite completely true - In many cases you can associate it to a user based on their activity too. For example, they might logon which would link the IP to an identity.
  - janosett 3y ago
    Yes, but the IP itself is not personal without the connection to other information. I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses.
    - BaseballPhysics 3y ago
      > Yes, but the IP itself is not personal without the connection to other information. By this argument, isn't the same true of a physical home address? > I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses. Except that isn't strictly "the common case". DHCP leases are often for long-ish periods of time on fixed line broadband services. The IP for my home router, for example, has been the same for weeks or months at a time.
    - daveoc64 3y ago
      The concept of being able to identify individuals by combining data sources is a key part of GDPR. If you can look up a user account by IP address, then the IP address is personal data.
whiplash451 3y ago
The real question is why would a service like recaptcha need the ip of the user to operate?
- jonas-w 3y ago
  IP reputation/blocking. Often datacenters have a bad IP reputation and if you access a site with a captcha from a datacenter IP, you will often get more/harder/slower captchas to solve. Some IPs are completely restricted from accessing sites which have captchas, if they are known to be used for spamming.
- butlerm 3y ago
  Embedded references to external javascript libraries, fonts, images, and so on on a web page are resolved by the browser by making a connection to the service that hosts the resource, and connections over the Internet necessarily involve two IP addresses of some sort, the IP address of the requester (or a requester) and the IP address of the responder. Every web browser works that way by default. There are two basic choices to avoid that - in some cases you can just host the resources yourself so the client browser does not connect to hosts operated by others, or you can operate a proxy so that the client browsers requests are relayed and anonymized before going to a third party.
fooker 3y ago
When everything is illegal, nothing is.
pabe 3y ago
Hahaha, so EU service providers can't protect their website using Google reCAPTCHA because it'd likely need user's consent and they're not allowed to restrict their offering in case a user doesn't consent. So, bots simply deny consent and send the form without captcha :'-D Did I get that right? That's nuts.
- spiderfarmer 3y ago
  Lots of alternatives who claim to be GDPR compliant though.
- littlestymaar 3y ago
  > and they're not allowed to restrict their offering in case a user doesn't consent. French newspapers don't seem to agree with your interpretation of GDPR, as you are almost always facing a “consent or pay”-wall…
  - siilats 3y ago
    I would say that you need to call a phone number to verify you as a user if you don't consent to captcha. And then that number is a voicemail leave your number we will call you back. And then we have a backlog so it takes us a while to call back. I don't think that's illegal.
frozenlettuce 3y ago
My favorite thing is going into a non-us government site and having to solve a recaptcha with a US-centric thing: "Mark all the school buses", "Mark all the stop signs"
- xeromal 3y ago
  I'd love if I started getting captachs for some weird local food like "Select all the pao de quechos" or something like that. lol
  - throwawaymobule 3y ago
    like most Google things, recaptcha is localised based on your location, so I've had to deal with French, German, and occasional Spanish instructions while travelling before. with no easy way to change it. (adding &hl=en to the captcha URL fixes it, but good luck with that) Hitting refresh until I got one with an example picture was pretty common until I learned some vocab. I should really make a browser extension for this.
lucb1e 3y ago
TL;DR: no³ Slightly longer summary: if consent is granted, then you can use ReCAPTCHA³, but a bot programmer would just choose to have the bot click no on the consent prompt. Denying access after nonconsent is allegedly² illegal because attaching negative consequences to the 'no' button makes the 'yes' button no longer be considered a freely given consent¹. ¹ https://autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies https://autoriteitpersoonsgegevens.nl/themas/internet-slimme... "Mag een website of app mij toegang weigeren als ik geen tracking cookies accepteer? \n\n Nee. U moet de mogelijkheid krijgen om tracking cookies te weigeren. Zonder dat dit nadelige gevolgen voor u heeft." Basically says: can I be denied if I say no to consent? No, it may not have negative consequences. (Don't y'all love national authorities' information about EU-wide legislation? So much fun translating for english audiences) ² because a judge can overturn what the data protection authority (DPA) claims. I am not aware of case law on this, but I am not a lawyer. ³ assuming this French DPA speaks for all of the EU, which is not an automatic truth, but almost always the case. There may be implementation differences but I am not aware of any significant ones. The only annoying part is that each country's DPA has to put their stamp on it to reaffirm it for that country, and humans tend to have a bit of RNG in what opinion they end up forming based on the same text.
nickpp 3y ago
As a simple engineer who just wants to create and not spend time with lawyers, it is time to update my list of technologies made too dangerous to use by GDPR: 1. Analytics 2. Third-party resources 3. CDNs 4. DDOS protection services 5. reCAPTCHA Anything else?
- XCSme 3y ago
  Servers
mk89 3y ago
An alternative would be to use something like https://friendlycaptcha.com/privacy/gdpr/ https://friendlycaptcha.com/privacy/gdpr/ I guess?

143 points by openplatypus 3y ago

The article title is "Is Google reCAPTCHA GDPR Compliant?" And its a good point — broad data collection has always attracted the mire of European regulators, and in the decision they state that they find that reCaptcha serves as both a security and analytics tool (due to its broad data capture.) I can't argue with that definition. The solution, for Google, is to only conduct telemetry after the user has authorised that telemetry, allowing reCaptcha to function without the data collection consent. They already have such functionality in Google Analytics, but arguably, might be less valuable for Google without that data. For the businesses using reCaptcha, its a problem. The article makes a fair point that you can't use the service if the user declines consent. But it is a reminder that any business operating in the EU at this scale must incorporate a data privacy specialist into their requirements gathering and review processes. It's just the price of the ticket to play in the EU.

miohtama 3y ago
You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. Thus, no special consent is needed. The different question is that if Google uses this data for purposes it is not intended. In this case the service might be still GDPR compliant from the website implementor point of view, but Google would be doing fraud by breaking their Terms of Service how the data is handled.
- croes 3y ago
  If a service doesn't work without respecting user rights, the service can't be used. What's next? Capture a picture of your webcam to check if a real person is sitting in front of the PC?
  - mozman 3y ago
    This is already happening, with some remote working platforms requiring the camera on during working hours Twitter also requires the employee to be in a dedicated room with a door that closes. At least they used to.
  - manmal 3y ago
    Some KYC processes in the EU (and likely elsewhere) do involve a webcam interview with a 3rd party who checks the customer‘s face and passport.
- krzyk 3y ago
  The question is also, why separate humans from bots? It makes creating useful scripts harder, doesn't it fall into "fair use" case which in EU is enforced even in software where you can modify it to be able to run it on your platform.
  - dageshi 3y ago
    To prevent or at least cut down on spam? Pretty much the entire reason captcha systems were created in the first place and an entirely legitimate reason?
    - fkyoureadthedoc 3y ago
      In addition to spam, preventing bots from buying up all the GPUs and PS5s in the recent past would have been nice.
      - pph 3y ago
        Though in the end you're the one clicking busses and bikes and bridges and busses again and when you're through that charade, everything is gone anyway because the bots were faster/better at that..
  - miohtama 3y ago
    It is up to the website owner to decide how they want to distribute the content, not the reader. What you see as fair is often not fair from the website owner point of view. If you disagree with this you are always free to create a competing business without such captcha limitations for bots, and put your money where your mouth is.
  - mozman 3y ago
    Think about why the bots exist - it's almost always data theft or other schemes to abuse your API to profit. Taking money from your pocket.
- rypskar 3y ago
  >>because it is needed in order to perform the core function to separate bots from humans The core function for most sites using recaptcha is not to separate bots from humans, so a consent is needed before sending data to a 3rd party not related to the core functions of the site or app
- jeroenhd 3y ago
  This does seem like a good legitimate use case. However, if Google transfers the data collected to its American servers or daughter companies, that would still make for a massive GDPR violation, both for Google for breaking the law and, if the situation does not get resolved, possibly for the companies using Google's services while it knowingly violates the law.
- cassianoleal 3y ago
  > You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. You would have a hard time arguing that. The core function to separate bots from humans is done by requiring the user to identify certain images. The only data that needs to be "collected" (and even that doesn't need to be kept) is whether they clicked the correct squares.
  - jefftk 3y ago
    That is not most of how it identifies bot traffic. The order you click them, how quickly you click, and where within each square you click for all ways humans and computers can be different. But the real work is not about your interaction at all: this is how the invisible version can perform almost as well as the one where you click things. This involves comparing information about your computer's JavaScript environment with what they have seen elsewhere, and if you are running a bot farm it's pretty hard to keep your statistical distribution for all of these different attributes from looking odd.
    - cassianoleal 3y ago
      > how the invisible version can perform almost as well as the one where you click things I don't think it does for me. I run most websites in temporary containers, I do a lot of tracker blocking on DNS, uBo, etc., I clean cookies frequently. Either those CAPTCHAs are really bad and are considering me human when they shouldn't, or all those things you mentioned are not necessary for their core functionality.
      - jefftk 3y ago
        Several of the non-interactive signals would still pass through in those sorts of situations. I don't know exactly what reCAPTCHA collects, but if you look at something like https://amiunique.org/fingerprint https://amiunique.org/fingerprint you can get a similar idea of what's possible.
        3y ago
hnbad 3y ago
> But it is a reminder that any business operating in the EU at this scale must incorporate a data privacy specialist into their requirements gathering and review processes. It's just the price of the ticket to play in the EU. This sounds very American. You don't need a data privacy specialist to operate in the EU. You need to develop with privacy first by design. Treat all PII as radioactive. Literally. Yes, if you need to bolt this onto existing US software to make it "compliant", you're screwed and you'll need to call in a containment team like when you find radioactive cargo in your business that is not normally expected to handle it. A lot of times topics like GDPR and privacy are brought up on HN I'm seeing comments that act like it's black magic. It really isn't. It's trivial to be "good enough" as far as legislation is concerned. The problem is just that over the past decades and especially in the US we've seen myriads of online services sprout up that now often seem integral but were built with a complete disregard for privacy and now need to either be retrofitted or somehow contained to become compliant. It's like finding out paint is radioactive after it has been marketed for decades with no regulation or oversight. Internet companies have been playing it fast and loose with privacy well past the point that people started pointing out it's a (ethical if not legal yet) problem. That is now coming back to bite them. I'm okay with that. It's just a shame so many businesses are caught in the crossfire because those companies have also tried their best to make themselves integral and unavoidable. Good luck trying to migrate away from AWS/Azure/GCP for example.
- mbork_pl 3y ago
  > It's trivial to be "good enough" as far as legislation is concerned. I'd be very interested to read any tutorials/howtos/faqs/etc. about that. I might be tempted to create a (very small) side SaaS-type project (and I'm located in Europe), and the main reason I haven't done it yet is that GDPR compliance looks really, really scary to me.
- mozman 3y ago
  Being compliant with regulations such as the GDPR is expensive. Lawyers, security, and annual third party testing. I don't profit off EU users so I block all non-USA traffic and avoid the issue entirely.
jdietrich 3y ago
It's almost certainly possible to defend the use of a reCAPTCHA-like tool without user consent under article 6 para 1(f) (legitimate interests). My concern with using reCAPTCHA would be the track record of Google - they have a long history of testing the boundaries of data protection law and accepting fines as a cost of doing business. Google don't appear to even mention GDPR in the marketing materials or docs for reCAPTCHA; they do claim that reCAPTCHA Enterprise (a separate, paid-for product) can be GDPR compliant, but I'd take that with a big pinch of salt. Competing CAPCHA services make much stronger claims regarding GDPR compliance and are much more transparent about how the service uses personal information.

sylware 3y ago

It is a grey/not well known area: as far as I know it is not working with noscript/basic (x)html browsers, which is paramount for past/present/future interoperability between big tech and small tech.

matusp 3y ago

This is the problem with the catch-all EU regulation. They needlessly create regulations that are so vague and broad that even completely bening activities are prohibited and you need your own law department to understand what exactly is required. Can't wait for the yet another button-clicking exercise when you will have to accept all the ToS of reCAPTCHA. Similar situation happening in the AI regulations. They are not sure what AI is or what it can do wrong, so they just slap a bunch of red tape on top of it and call it a day.

raverbashing 3y ago
"fully benign" yes I'm sure Google is providing the service for free and not relying on the data it collects... Though you're right that captcha/fonts etc should have been benign uses, if it could be anonymized/proxied then maybe that would have been a good solution.
- deleted 3y ago
  [deleted]
croes 3y ago
Stop tracking people and you need no consent and banner. BTW the sides could simply respect the Do-Not-Track flag but somehow they prefer to annoy their users, just like it's on purpose to blame privacy laws.
- matusp 3y ago
  I see no mention of reCAPTCHA tracking users. They are "sending data about device and application data", which seems like a completely natural thing considering what reCAPTCHA is used for.
  - croes 3y ago
    Since the reCAPTCHA code is loaded from the google.com domain, among others, the tool automatically gains access to cookies that are set for logged-in Google users. One of the cookies is called NID and contains a unique user ID that is also used for Google Signals to recognize users even across devices. In this respect, it is almost irrelevant from a data protection perspective whether reCAPTCHA (situationally) sets further cookies or not. In addition, reCAPTCHA also accesses the domain gstatic.com. As can be read on Google websites, this domain is also used by other tools. Thus, cookies can potentially be exchanged via this domain.

phoronixrly 3y ago

We've assumed this for a while now. We've stopped using reCAPTCHA together with all other services that may be sending our users' data outside of EU. As a developer, personally I am very happy with this decision, and am thankful that the GDPR is finally making management take user privacy into account.

dbbk 3y ago

This is taking the piss now

draw_down 3y ago
[dead]

Lornedon 3y ago

> We’re using “cookies” as a shorthand for any technologies that can access or store information on a person’s device. This can also include beacons, pixels, scripts, and other technologies. That is a weird use of the word "cookie". In normal usage, it doesn't mean a technology that accesses or stores the information, it is that information itself. "Pixels" is also weird. I think that they mean tracking pixels, which are one-pixel images that are just there so that the browser has to request them from the server and the server can notice that request. They are a subclass of "Beacons". Calling them a "technology that can access or store information on a person's device" seems misleading. Also, reCaptcha wouldn't need them. They already have Javascript running on my PC, they don't need a tracking pixel to contact the server.

Akronymus 3y ago
Pixels likely refers to 1x1 tracking images (image fetched from a server, and through that, they can get some data from you, like IP address or visited before)
- Lornedon 3y ago
  Sorry, I sent my comment before it was done. It's edited now.
  - Akronymus 3y ago
    Yeah, I see your edit. With JS you can also detect whether it was fetched before, so that is a way of storing information about whether you have visited something before. Which can then be sent to the server. So, it kinda is storing data, kinda not.
smeagull 3y ago
In the end, you just use the cookie to store a unique id, and store everything on the server.
ahoka 3y ago
Cookies mean exactly that. You are just being overly pedantic. And yes, running JS in a users browser to store or access information is exactly the same. Taking a browser fingerprint and storing it server side is also the same, just harder to get caught doing. This whole trying to maliciously take these laws literally need to stop.

sam0x17 3y ago

captchas aren't going to be effective for much longer anyway with the recent dramatic improvements in AI

dawnerd 3y ago
Honestly captchas haven’t been effective for a while. They’ve been pretty trivial to bypass.
- mozman 3y ago
  It may be trivial but costs money at scale - which is the entire point of PoW.
manmal 3y ago
Maybe proof of work based captchas will be a viable alternative, like https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha: > mCaptcha makes interacting with websites (computationally) expensive for the user. A well-behaving user will experience a slight delay (no delay when under moderate load to 2s when under attack; PoW difficulty is variable) but if someone wants to hammer your site, they will have to do more work to send requests than your server will have to do to respond to their request.
- sam0x17 3y ago
  Proof of annoyance
- slondr 3y ago
  So, banning low-compute-capacity clients in the worst way possible. Awesome.
  - ahoka 3y ago
    If you want to register to my site from your smart thermometer, then it’s your problem.

JacobSeated 3y ago

Well, it is also unnecessary, as simple OSS solutions exist. Users however tend to be greatly annoyed and inconvenienced by reCAPTCHA, which has grown increasingly difficult to decipher for real users. It is basically insulting to present real users with a CAPTCHA.

jwr 3y ago

CAPTCHAs are overused because of groupthink and fashions/fads. Before you use a CAPTCHA of any kind, consider very carefully if you really need one. I've seen this a number of times in design meetings: someone will say "oh, an account registration form, we will of course need a CAPTCHA there", everyone will nod their heads and move on. In reality, in most of those cases, no one will ever conceivably even try to automate/script the thing being designed.

smeagull 3y ago
Spam is ever present, and Captchas protect from the massive torrent of trash.
Zardoz84 3y ago
i had to put a CAPTCHA system on a public register form for digital libraries, because they were getting spammed by bots.
efields 3y ago
We ignored them until we needed them. Then we needed them.
danuker 3y ago
> no one will ever conceivably even try to automate/script the thing being designed. Spammers will spam everywhere they can. My minuscule personal site suffers from it very rarely, but I can imagine anyone getting a lot of page views making it worth it.
- yonixw 3y ago
  On my custom built site I have none of those. But, on my WordPress site, I had to install captcha the second days. Spammers are just using scripts, which cost next to nothing...
  - eli 3y ago
    If a site gets even a little popular it attracts spam and security scanners and other nonsense no matter how it's built.

londons_explore 3y ago

Note that reCAPTCHA's use of hashing and encryption might mean that the private data this article refers to, such as device type, is not actually sent to google. A quick check with the network inspector doesn't obviously show this data being sent. And obviously to punish a company, the EU would need to prove this data is sent - a hard thing to do when the code of recaptcha is deliberately designed to prevent reverse engineering and analysis.

jeroenhd 3y ago
My French isn't exactly great but based on the machine translation of the linked court case, I believe the problem with reCAPTCHA is that Google uses it for more than just authenticating users. The generated fingerprint for these scripts is personal data, it pretty much directly refers to you as a person, that's the intention of the system. That's not necessarily a problem, though. These types of detection algorithms are perfectly allowed without explicit consent, just like other types of fraud and abuse detection.

TekMol 3y ago

The mistake here in Europe is that an ip address is considered personal information: https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-google-web-fonts-ist-dsgvo/ https://www.ra-plutte.de/lg-muenchen-dynamische-einbindung-g... This makes it impossible to use any components hosted by third parties without getting consent by the users. And for components hosted in a different country than the visitor, even consent might not make using those external components legal. This is bad and not in line with reality. The IP can only be turned into personal information via cooperation of the users internet provider. So in Europe, the whole internet is made illegal based on a wrong assumption.

jdsnape 3y ago
That is not quite completely true - In many cases you can associate it to a user based on their activity too. For example, they might logon which would link the IP to an identity.
- janosett 3y ago
  Yes, but the IP itself is not personal without the connection to other information. I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses.
  - BaseballPhysics 3y ago
    > Yes, but the IP itself is not personal without the connection to other information. By this argument, isn't the same true of a physical home address? > I do think considering IP address personal is a bit of a reach, especially given the common case of ephemeral addresses. Except that isn't strictly "the common case". DHCP leases are often for long-ish periods of time on fixed line broadband services. The IP for my home router, for example, has been the same for weeks or months at a time.
  - daveoc64 3y ago
    The concept of being able to identify individuals by combining data sources is a key part of GDPR. If you can look up a user account by IP address, then the IP address is personal data.

whiplash451 3y ago

The real question is why would a service like recaptcha need the ip of the user to operate?

jonas-w 3y ago
IP reputation/blocking. Often datacenters have a bad IP reputation and if you access a site with a captcha from a datacenter IP, you will often get more/harder/slower captchas to solve. Some IPs are completely restricted from accessing sites which have captchas, if they are known to be used for spamming.
butlerm 3y ago
Embedded references to external javascript libraries, fonts, images, and so on on a web page are resolved by the browser by making a connection to the service that hosts the resource, and connections over the Internet necessarily involve two IP addresses of some sort, the IP address of the requester (or a requester) and the IP address of the responder. Every web browser works that way by default. There are two basic choices to avoid that - in some cases you can just host the resources yourself so the client browser does not connect to hosts operated by others, or you can operate a proxy so that the client browsers requests are relayed and anonymized before going to a third party.

fooker 3y ago

When everything is illegal, nothing is.

pabe 3y ago

Hahaha, so EU service providers can't protect their website using Google reCAPTCHA because it'd likely need user's consent and they're not allowed to restrict their offering in case a user doesn't consent. So, bots simply deny consent and send the form without captcha :'-D Did I get that right? That's nuts.

spiderfarmer 3y ago
Lots of alternatives who claim to be GDPR compliant though.
littlestymaar 3y ago
> and they're not allowed to restrict their offering in case a user doesn't consent. French newspapers don't seem to agree with your interpretation of GDPR, as you are almost always facing a “consent or pay”-wall…
- siilats 3y ago
  I would say that you need to call a phone number to verify you as a user if you don't consent to captcha. And then that number is a voicemail leave your number we will call you back. And then we have a backlog so it takes us a while to call back. I don't think that's illegal.

frozenlettuce 3y ago

My favorite thing is going into a non-us government site and having to solve a recaptcha with a US-centric thing: "Mark all the school buses", "Mark all the stop signs"

xeromal 3y ago
I'd love if I started getting captachs for some weird local food like "Select all the pao de quechos" or something like that. lol
- throwawaymobule 3y ago
  like most Google things, recaptcha is localised based on your location, so I've had to deal with French, German, and occasional Spanish instructions while travelling before. with no easy way to change it. (adding &hl=en to the captcha URL fixes it, but good luck with that) Hitting refresh until I got one with an example picture was pretty common until I learned some vocab. I should really make a browser extension for this.

lucb1e 3y ago

TL;DR: no³ Slightly longer summary: if consent is granted, then you can use ReCAPTCHA³, but a bot programmer would just choose to have the bot click no on the consent prompt. Denying access after nonconsent is allegedly² illegal because attaching negative consequences to the 'no' button makes the 'yes' button no longer be considered a freely given consent¹. ¹ https://autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies https://autoriteitpersoonsgegevens.nl/themas/internet-slimme... "Mag een website of app mij toegang weigeren als ik geen tracking cookies accepteer? \n\n Nee. U moet de mogelijkheid krijgen om tracking cookies te weigeren. Zonder dat dit nadelige gevolgen voor u heeft." Basically says: can I be denied if I say no to consent? No, it may not have negative consequences. (Don't y'all love national authorities' information about EU-wide legislation? So much fun translating for english audiences) ² because a judge can overturn what the data protection authority (DPA) claims. I am not aware of case law on this, but I am not a lawyer. ³ assuming this French DPA speaks for all of the EU, which is not an automatic truth, but almost always the case. There may be implementation differences but I am not aware of any significant ones. The only annoying part is that each country's DPA has to put their stamp on it to reaffirm it for that country, and humans tend to have a bit of RNG in what opinion they end up forming based on the same text.

nickpp 3y ago

As a simple engineer who just wants to create and not spend time with lawyers, it is time to update my list of technologies made too dangerous to use by GDPR: 1. Analytics 2. Third-party resources 3. CDNs 4. DDOS protection services 5. reCAPTCHA Anything else?

XCSme 3y ago
Servers

mk89 3y ago

An alternative would be to use something like https://friendlycaptcha.com/privacy/gdpr/ https://friendlycaptcha.com/privacy/gdpr/ I guess?