ReCAPTCHA Privacy Policy Change

[rfultz]

Summary

What we're after:
Google is changing their role around ReCAPTCHA

We are excited to announce that reCAPTCHA is switching from a “data controller” offering to a “data processor” offering on April 2, 2026 and will begin processing reCAPTCHA data in alignment with other Google Cloud services. With this switch, customers deploying reCAPTCHA on their websites will become data controllers, determining the purpose and means of processing their users’ personal data, while Google will become a data processor, processing the data collected on our customers' websites as instructed by our customers.

How does this affect us? Is there anything we need to

• get approval for?
• remove, add, clarify, or otherwise change on the front-end?
• change as far as our Google account(s)(?) or provider in general?

Related issues

List any relevant related issue(s)

• #[issue_number]
• #[issue_number]

Completion criteria

What does the end state look like? Include any behavior, appearance, etc required for this ticket to be 'complete.'

• We have researched and reached out to OGC and have a plan
• Have created implementation tickets

Tech steps or considerations (optional)

List any considerations the tech team should know. Additionally, any specific tech steps can be included here.

• Research policies to find out more about what the new terms will be for the use of reCaptcha
• Reach out to OGC with findings and what , if any, ramifications may be (@isaacjamesbaker)

Future work

Other future work that may be needed following this issue's completion.