_GRECAPTCHA Cookie: What It Is, Who Sets It, and Consent Rules

What the _GRECAPTCHA Cookie Does on Your Site

The _GRECAPTCHA cookie is a third-party functionality cookie that Google reCAPTCHA sets on www.google.com to support the risk analysis that tells people and bots apart. Google reCAPTCHA "sets a necessary cookie (_GRECAPTCHA)" when reCAPTCHA runs, for the purpose of its risk analysis, according to the Google Cloud Fraud Defense FAQ. The reCAPTCHA servers send the _GRECAPTCHA cookie in an HTTP response, so no script on your page writes the cookie and the cookie never appears under your own domain. Your cookie scanner shows the _GRECAPTCHA cookie under www.google.com with the path /recaptcha.

Google renamed reCAPTCHA Enterprise to Google Cloud Fraud Defense, and the classic reCAPTCHA script from www.google.com/recaptcha/api.js sets the same _GRECAPTCHA cookie.

Who Sets the _GRECAPTCHA Cookie

Google reCAPTCHA sets the _GRECAPTCHA cookie from the servers of Google once the reCAPTCHA widget runs on your page. A scan by the TermsFeed website auditor from France on 9 October 2026 found the _GRECAPTCHA cookie on www.google.com with the path /recaptcha. The cookie arrived in the response of the reCAPTCHA Enterprise endpoint www.google.com/recaptcha/enterprise/reload, with HttpOnly, Secure, and SameSite=None.

The same scan found the _GRECAPTCHA cookie after the visitor clicked "Decline all", because the site loaded reCAPTCHA on every page outside its consent banner.

Read how Google LLC handles the data in the Google reCAPTCHA privacy policy, and sign the Google Cloud Data Processing Addendum before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the _GRECAPTCHA Cookie Need Consent?

Yes, the _GRECAPTCHA cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Google reCAPTCHA, such as the forms that load reCAPTCHA.

The ePrivacy Directive requires consent before a site sets the _GRECAPTCHA cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) require consent before a site sets the _GRECAPTCHA cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the _GRECAPTCHA cookie. Visitors get no right to opt out of the _GRECAPTCHA cookie while Google reCAPTCHA acts as your service provider. The service provider role needs a contract that limits the use of the data to the service for your site.

Google describes the _GRECAPTCHA cookie as "a necessary cookie" for its risk analysis. The ePrivacy Directive exempts only storage that is strictly necessary for a service the visitor asks for, and the European Data Protection Board (EDPB) assesses that necessity case by case. The TermsFeed Privacy Consent template therefore places Google reCAPTCHA in the Functionality vendor category for every page outside the forms that need reCAPTCHA.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the _GRECAPTCHA Cookie Until Visitors Accept

Block the _GRECAPTCHA cookie by holding back the reCAPTCHA script (api.js) until the visitor accepts functionality cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place Google reCAPTCHA in the functionality category. Check whether an exemption applies to your own use of Google reCAPTCHA in the consent rules for the _GRECAPTCHA cookie.

Google reCAPTCHA sets no _GRECAPTCHA cookie while the reCAPTCHA script waits as a tagged script. The forms that rely on reCAPTCHA then need a fallback, such as a consent note that asks the visitor to accept.

<script type="text/plain" data-cookie-consent="functionality" src="https://www.google.com/recaptcha/api.js" async defer></script>

How to Verify That the _GRECAPTCHA Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The _GRECAPTCHA cookie must not appear in the list until you accept functionality cookies.

How Long the _GRECAPTCHA Cookie Lasts

The _GRECAPTCHA cookie lasts 180 days (6 months).

Google gives no lifetime for the _GRECAPTCHA cookie in the Google Cloud Fraud Defense FAQ. The TermsFeed website auditor measured an expiry of 180 days (6 months) on 9 October 2026, and the TermsFeed Privacy Consent template lists 6 months.

Scripts and Requests of Google reCAPTCHA That Come With the _GRECAPTCHA Cookie

The catalog lists 2 scripts, pixels, and data endpoints of Google reCAPTCHA, which a cookie scanner or the Network tab of Chrome DevTools shows next to the _GRECAPTCHA cookie. Block the main script, and the requests in the table stop with the main script.

Changes to the _GRECAPTCHA Cookie

The catalog records 1 dated change that affect the _GRECAPTCHA cookie. The newest change comes first.

_GRECAPTCHA Cookie FAQs

Is _GRECAPTCHA a necessary cookie?

No, the _GRECAPTCHA cookie is not a strictly necessary cookie on every page, although Google calls the cookie "a necessary cookie". Firstly, the exemption covers storage strictly necessary for a service the visitor asks for, such as a login. Secondly, a reCAPTCHA script on every page serves no service that the visitor asked for on those pages. Thirdly, the TermsFeed Privacy Consent template places reCAPTCHA in the Functionality vendor category for the pages outside the forms that need reCAPTCHA.

Does reCAPTCHA set cookies?

Yes, Google reCAPTCHA sets the _GRECAPTCHA cookie on www.google.com. Firstly, the Google Cloud Fraud Defense FAQ states that reCAPTCHA "sets a necessary cookie (_GRECAPTCHA)" when reCAPTCHA runs. Secondly, the reCAPTCHA servers send the cookie in an HTTP response with the path /recaptcha. Thirdly, the TermsFeed website auditor found the cookie with a 180-day expiry on a scanned site.

Does the _GRECAPTCHA cookie appear under my own domain?

No, the _GRECAPTCHA cookie appears under www.google.com, never under your own domain. Firstly, the reCAPTCHA servers of Google send the cookie. Secondly, the cookie carries the path /recaptcha, so the browser sends the cookie only to reCAPTCHA. Thirdly, the HttpOnly flag hides the cookie from the scripts on your page.

How do I avoid other Google cookies with reCAPTCHA?

Load reCAPTCHA from www.recaptcha.net instead of www.google.com, the domain the Google Cloud Fraud Defense FAQ names for sites that want to avoid other Google cookies. Replace www.google.com with www.recaptcha.net in the URL of the reCAPTCHA script and keep the rest of the code.