Functionality vendor · Google LLC
Google reCAPTCHA Cookies: List With Purpose and Retention
Last verified 2026-10-17 · Updated 2026-10-17
On this page
Cookies Google reCAPTCHA Sets on Your Site
Google reCAPTCHA sets 1 cookie of its own, _GRECAPTCHA on www.google.com, and reCAPTCHA loads from the domains of Google on every page with a reCAPTCHA form.
| Name | Type | Category | Party | Retention | What it does |
|---|---|---|---|---|---|
_GRECAPTCHA | Cookie | Functionality | Third-party | 180 days (6 months) | The _GRECAPTCHA cookie is a Google reCAPTCHA functionality cookie that serves its bot risk analysis for 6 months, and Google calls the cookie necessary. |
Scripts, Pixels, and Endpoints Google reCAPTCHA Loads
Google reCAPTCHA loads 2 known scripts, pixels, and data endpoints. Each row gives the host to look for in the Network tab of Chrome DevTools or in a cookie scanner report.
| Type | Resource | Host | What it does |
|---|---|---|---|
| Script | reCAPTCHA script (api.js) | www.google.comwww.recaptcha.net | The reCAPTCHA script loads the reCAPTCHA widget, whose requests to www.google.com/recaptcha/ set the _GRECAPTCHA cookie. |
| Script | reCAPTCHA Enterprise script (enterprise.js) | www.google.com | The reCAPTCHA Enterprise script of Google Cloud Fraud Defense loads the risk analysis, whose requests set the _GRECAPTCHA cookie. |
Does Google reCAPTCHA Need Consent?
Yes, the Google reCAPTCHA cookies need consent in the EU and the UK, and need no prior opt-in in California. The table gives the rule for each law, taken from the page of the _GRECAPTCHA cookie.
| Law | Consent before the cookies are set | Opt-out right | Source |
|---|---|---|---|
| EU ePrivacy Directive + GDPR | Required | Withdraw at any time | Article 5(3), ePrivacy Directive |
| UK PECR | Required | Withdraw at any time | Regulation 6 and Schedule A1, PECR |
| California CCPA | No general opt-in | None while the vendor acts as a service provider | Cal. Civ. Code 1798.120 |
The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Google reCAPTCHA, such as the forms that load reCAPTCHA.
Read the reason for each answer in the consent rules for the _GRECAPTCHA cookie.
How to Add Google reCAPTCHA to a Consent Banner
Add Google reCAPTCHA to a consent banner by holding back the reCAPTCHA script (api.js) until the visitor accepts functionality cookies. Both TermsFeed products block Google reCAPTCHA in the Functionality category.
Add Google reCAPTCHA to TermsFeed Free Cookie Consent
TermsFeed Free Cookie Consent runs a tagged script only after the visitor accepts its category. Change type="text/javascript" to type="text/plain" and add data-cookie-consent="functionality".
<script type="text/plain" data-cookie-consent="functionality" src="https://www.google.com/recaptcha/api.js" async defer></script>Cookie Consent is free and needs no account. Build your free consent banner with TermsFeed Free Cookie Consent.
Add Google reCAPTCHA to TermsFeed Privacy Consent
Add Google reCAPTCHA from its template in TermsFeed Privacy Consent. The reCAPTCHA script then loads on pages outside your login and payment forms only after the visitor accepts the Functionality vendor category. The template loads the script once, renders the check in each g-recaptcha container, and hides the consent notes of your forms.
The Google reCAPTCHA template asks for no ID and fills every field of the vendor. Pick the "Google reCAPTCHA" card under Functionality and click "Add Google reCAPTCHA". The illustration shows the template form in the TermsFeed app.
Privacy Consent detects the location of each visitor and records every answer in a consent log. Set up Google reCAPTCHA from its template with TermsFeed Privacy Consent.
Follow every step, the vendor settings, and the check in Chrome DevTools in how to block the _GRECAPTCHA cookie.
Who Runs Google reCAPTCHA
Google LLC runs Google reCAPTCHA from the United States, and Google Ireland Limited provides Google services to users in the European Economic Area (EEA) and Switzerland. Google renamed reCAPTCHA Enterprise to Google Cloud Fraud Defense, and Google processes the data of Fraud Defense customers under the Google Cloud Data Processing Addendum.
Read how Google LLC handles the data in the Google reCAPTCHA privacy policy, and sign the Google Cloud Data Processing Addendum before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.
Google reCAPTCHA Cookie FAQs
Does Google reCAPTCHA need consent?
Yes, the Google reCAPTCHA cookies need consent in the EU and the UK, and need no prior opt-in in California. Firstly, the ePrivacy Directive requires consent before a site sets the functionality cookies of Google reCAPTCHA. Secondly, the UK PECR requires consent before a site sets the functionality cookies of Google reCAPTCHA. Thirdly, the CCPA sets no general opt-in requirement for the functionality cookies of Google reCAPTCHA, and the table gives the opt-out right of visitors. The consent section of this page gives the table for each law.
How long do Google reCAPTCHA cookies last?
The _GRECAPTCHA cookie of Google reCAPTCHA lasts 180 days (6 months). The retention column of the cookie list gives the lifetime of each cookie.
How do I block Google reCAPTCHA cookies?
Block the Google reCAPTCHA cookies by holding back the reCAPTCHA script (api.js) until the visitor accepts functionality cookies. Tag the reCAPTCHA script (api.js) with data-cookie-consent="functionality" in TermsFeed Free Cookie Consent, or add Google reCAPTCHA as a vendor in TermsFeed Privacy Consent. The page of the _GRECAPTCHA cookie gives the full steps and the settings of Google reCAPTCHA.
Sources for the Google reCAPTCHA Cookies
The facts on this page come from the documentation Google publishes, checked on 2026-10-17. The list gives every source, so you check each fact yourself.
- Google Cloud Fraud Defense, Frequently asked questions
- Google for Developers, reCAPTCHA v2
- TermsFeed website auditor scan, 9 October 2026 (internal)
- Google reCAPTCHA privacy policy
- Google Cloud Data Processing Addendum