4 ms·

You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from

You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. Thus, no special consent is needed. The different question is that if Google uses this data for purposes it is not intended. In this case the service might be still GDPR compliant from the website implementor point of view, but Google would be doing fraud by breaking their Terms of Service how the data is handled.

croes 3y ago
If a service doesn't work without respecting user rights, the service can't be used. What's next? Capture a picture of your webcam to check if a real person is sitting in front of the PC?
- mozman 3y ago
  This is already happening, with some remote working platforms requiring the camera on during working hours Twitter also requires the employee to be in a dedicated room with a door that closes. At least they used to.
- manmal 3y ago
  Some KYC processes in the EU (and likely elsewhere) do involve a webcam interview with a 3rd party who checks the customer‘s face and passport.
krzyk 3y ago
The question is also, why separate humans from bots? It makes creating useful scripts harder, doesn't it fall into "fair use" case which in EU is enforced even in software where you can modify it to be able to run it on your platform.
- dageshi 3y ago
  To prevent or at least cut down on spam? Pretty much the entire reason captcha systems were created in the first place and an entirely legitimate reason?
  - fkyoureadthedoc 3y ago
    In addition to spam, preventing bots from buying up all the GPUs and PS5s in the recent past would have been nice.
    - pph 3y ago
      Though in the end you're the one clicking busses and bikes and bridges and busses again and when you're through that charade, everything is gone anyway because the bots were faster/better at that..
- miohtama 3y ago
  It is up to the website owner to decide how they want to distribute the content, not the reader. What you see as fair is often not fair from the website owner point of view. If you disagree with this you are always free to create a competing business without such captcha limitations for bots, and put your money where your mouth is.
- mozman 3y ago
  Think about why the bots exist - it's almost always data theft or other schemes to abuse your API to profit. Taking money from your pocket.
rypskar 3y ago
>>because it is needed in order to perform the core function to separate bots from humans The core function for most sites using recaptcha is not to separate bots from humans, so a consent is needed before sending data to a 3rd party not related to the core functions of the site or app
jeroenhd 3y ago
This does seem like a good legitimate use case. However, if Google transfers the data collected to its American servers or daughter companies, that would still make for a massive GDPR violation, both for Google for breaking the law and, if the situation does not get resolved, possibly for the companies using Google's services while it knowingly violates the law.
cassianoleal 3y ago
> You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. You would have a hard time arguing that. The core function to separate bots from humans is done by requiring the user to identify certain images. The only data that needs to be "collected" (and even that doesn't need to be kept) is whether they clicked the correct squares.
- jefftk 3y ago
  That is not most of how it identifies bot traffic. The order you click them, how quickly you click, and where within each square you click for all ways humans and computers can be different. But the real work is not about your interaction at all: this is how the invisible version can perform almost as well as the one where you click things. This involves comparing information about your computer's JavaScript environment with what they have seen elsewhere, and if you are running a bot farm it's pretty hard to keep your statistical distribution for all of these different attributes from looking odd.
  - cassianoleal 3y ago
    > how the invisible version can perform almost as well as the one where you click things I don't think it does for me. I run most websites in temporary containers, I do a lot of tracker blocking on DNS, uBo, etc., I clean cookies frequently. Either those CAPTCHAs are really bad and are considering me human when they shouldn't, or all those things you mentioned are not necessary for their core functionality.
    - jefftk 3y ago
      Several of the non-interactive signals would still pass through in those sorts of situations. I don't know exactly what reCAPTCHA collects, but if you look at something like https://amiunique.org/fingerprint https://amiunique.org/fingerprint you can get a similar idea of what's possible.
      - 3y ago

croes 3y ago

If a service doesn't work without respecting user rights, the service can't be used. What's next? Capture a picture of your webcam to check if a real person is sitting in front of the PC?

mozman 3y ago
This is already happening, with some remote working platforms requiring the camera on during working hours Twitter also requires the employee to be in a dedicated room with a door that closes. At least they used to.
manmal 3y ago
Some KYC processes in the EU (and likely elsewhere) do involve a webcam interview with a 3rd party who checks the customer‘s face and passport.

krzyk 3y ago

The question is also, why separate humans from bots? It makes creating useful scripts harder, doesn't it fall into "fair use" case which in EU is enforced even in software where you can modify it to be able to run it on your platform.

dageshi 3y ago
To prevent or at least cut down on spam? Pretty much the entire reason captcha systems were created in the first place and an entirely legitimate reason?
- fkyoureadthedoc 3y ago
  In addition to spam, preventing bots from buying up all the GPUs and PS5s in the recent past would have been nice.
  - pph 3y ago
    Though in the end you're the one clicking busses and bikes and bridges and busses again and when you're through that charade, everything is gone anyway because the bots were faster/better at that..
miohtama 3y ago
It is up to the website owner to decide how they want to distribute the content, not the reader. What you see as fair is often not fair from the website owner point of view. If you disagree with this you are always free to create a competing business without such captcha limitations for bots, and put your money where your mouth is.
mozman 3y ago
Think about why the bots exist - it's almost always data theft or other schemes to abuse your API to profit. Taking money from your pocket.

rypskar 3y ago

>>because it is needed in order to perform the core function to separate bots from humans The core function for most sites using recaptcha is not to separate bots from humans, so a consent is needed before sending data to a 3rd party not related to the core functions of the site or app

jeroenhd 3y ago

This does seem like a good legitimate use case. However, if Google transfers the data collected to its American servers or daughter companies, that would still make for a massive GDPR violation, both for Google for breaking the law and, if the situation does not get resolved, possibly for the companies using Google's services while it knowingly violates the law.

cassianoleal 3y ago

> You can argue the data collection is legit and does not need the user consent, because it is needed in order to perform the core function to separate bots from humans. You would have a hard time arguing that. The core function to separate bots from humans is done by requiring the user to identify certain images. The only data that needs to be "collected" (and even that doesn't need to be kept) is whether they clicked the correct squares.

jefftk 3y ago
That is not most of how it identifies bot traffic. The order you click them, how quickly you click, and where within each square you click for all ways humans and computers can be different. But the real work is not about your interaction at all: this is how the invisible version can perform almost as well as the one where you click things. This involves comparing information about your computer's JavaScript environment with what they have seen elsewhere, and if you are running a bot farm it's pretty hard to keep your statistical distribution for all of these different attributes from looking odd.
- cassianoleal 3y ago
  > how the invisible version can perform almost as well as the one where you click things I don't think it does for me. I run most websites in temporary containers, I do a lot of tracker blocking on DNS, uBo, etc., I clean cookies frequently. Either those CAPTCHAs are really bad and are considering me human when they shouldn't, or all those things you mentioned are not necessary for their core functionality.
  - jefftk 3y ago
    Several of the non-interactive signals would still pass through in those sorts of situations. I don't know exactly what reCAPTCHA collects, but if you look at something like https://amiunique.org/fingerprint https://amiunique.org/fingerprint you can get a similar idea of what's possible.
    - 3y ago