‘Are You Human?’ How Google’s ReCAPTCHA Secretly Harvests Your Data

Are you a bot that’s currently reading our website? If you aren’t, please verify your human status by solving a series of puzzles. That’s a scenario that most of us are familiar with. We go to a website, and before we proceed, we have to solve a series of puzzles or type out a string of random alphanumerics. That’s part of a CAPTCHA test to check for bots. Google employs something similar called reCAPTCHA, but unfortunately, it might be nothing more than spyware in disguise.

The Google reCAPTCHA spyware

YouTuber “Chuppl” recently published a video report that claims that Google’s reCAPTCHA v2 and v3 aren’t the safeguards against bots like we think. Instead, the Google reCAPTCHA system might be more sinister than bots and could be spyware, where it apparently tracks your browser history and cookies and sells that information to advertisers or other companies that are willing to pay for this kind of valuable information. In fact, the tracking data Google collects is estimated to be valued at a staggering $898 billion.

For instance, the reCAPTCHA v3 system, which only requires users to click a checkbox, might be collecting more data than we think. The system tracks mouse movement under the assumption that only humans can move a mouse, not bots. For the most part, that is true, but researchers told Chuppl that in addition to capturing mouse movement, it also collects user agent data and other bits of identifying information.

This is actually not necessarily new information. An Austrian federal court banned the use of the technology as it violated users’ privacy rights under the GDPR law.

Fight against bots

So, the question is, were these CAPTCHA systems evil all along? Maybe it started out with good intentions, but over time, companies like Google realized the treasure trove of user data they were sitting on and decided to monetize it.

It’s no secret that a lot of companies hate bots. Okay, maybe that’s not entirely true. Most companies hate bots that they didn’t build themselves. This is because bots cause a lot of issues not just for them but also for users. Bots can be made to impersonate other users. It can be used for spam. It can also be used for even more malicious purposes.

When Elon Musk was in the process of acquiring Twitter, he almost backed out of the deal citing that the platform had too many bots. So, it is understandable that companies use employee services like Captcha systems to help combat this digital scourge. However, researchers have found that these CAPTCHA systems actually do next to nothing to combat bots. A 2023 study by the University of California found that bots had no issues bypassing Google’s reCAPTCHA v3 system.

You can watch Chuppl’s full video report below.