TYPO3 reCAPTCHA Alternative: How to Replace reCAPTCHA on European Websites

reCAPTCHA on TYPO3 means cookies, US data transfers and a growing compliance burden that most DACH teams no longer want to carry. This guide explains what changed in 2026, which GDPR-compliant alternatives work with EXT:form and PowerMail and how to replace reCAPTCHA without touching every form individually.

Estimated reading time: 11 minutes

At a Glance

---

---

Why reCAPTCHA creates compliance friction on TYPO3

TYPO3 is the CMS of choice for many public-sector portals, university websites, healthcare platforms, and enterprise deployments across Germany, Austria, and Switzerland. These are exactly the environments where GDPR, procurement, and accessibility requirements receive the closest scrutiny. As a result, reCAPTCHA often creates more follow-up work on TYPO3 than teams expect. Three issues matter most.

• The _grecaptcha cookie persists. Google confirmed this after the April 2026 processor role change. Under the ePrivacy Directive, this cookie requires assessment under national rules. In Germany, Austria, and most EU member states, non-essential cookies require opt-in consent before being set. Whether the reCAPTCHA cookie qualifies as strictly necessary has been answered unfavorably in several DPA opinions, including decisions by the French CNIL and the Bavarian State Office for Data Protection Supervision.
• Data transfers to US infrastructure continue. Even after April 2026, verification requests route through Google’s infrastructure. For TYPO3 operators in regulated sectors, this requires active transfer documentation (Standard Contractual Clauses or adequacy decision coverage), periodic review, and disclosure in the site’s privacy notice.
• Behavioral data collection can raise Article 35 DPIA questions. reCAPTCHA v3 collects mouse movements, typing patterns, and browser fingerprints. On public-sector, healthcare, or otherwise higher-risk TYPO3 deployments, this type of processing can trigger a Data Protection Impact Assessment review under GDPR Article 35. Whether a DPIA is required depends on the concrete deployment, the scope of processing, and the operator’s broader risk profile, but the governance burden is often higher than teams expected when they originally installed the extension.

For TYPO3 deployments in the public sector, healthcare or financial services, the compounded effect is significant: reCAPTCHA turns what should be a simple spam-protection decision into a recurring legal review task.

---

What the April 2026 reCAPTCHA change means for TYPO3 operators

On April 2, 2026, Google restructured reCAPTCHA under a processor model. Your organisation becomes the sole data controller for reCAPTCHA Customer Data. This is a meaningful structural change, but it does not remove the practical obligations for TYPO3 operators.

The _grecaptcha cookie remains unchanged. You now need to update your TYPO3 site’s privacy notice to remove references to Google’s Privacy Policy and Terms of Service, since those no longer reflect the legal roles accurately from April 2, 2026. If your site exceeds 10,000 reCAPTCHA assessments per month, you also need billing configured in Google Cloud Console; otherwise the extension returns errors and your forms lose bot protection silently.

For TYPO3 agencies managing multiple client sites, this creates a concrete project: privacy notice updates, consent mechanism reviews, and potentially Google Cloud billing setup across a portfolio. Many are using this moment to evaluate whether switching to a cookieless alternative removes more work than it creates.

For a detailed breakdown of the April 2026 changes, see Migrate from Google reCAPTCHA to CAPTCHA.eu and Is Google reCAPTCHA GDPR-Compliant in 2026?

---

TYPO3 reCAPTCHA alternatives compared

Several CAPTCHA solutions offer TYPO3 extensions. They differ significantly on cookies, data location, form framework support, and the compliance overhead they leave to the operator.

SOLUTION	MECHANISM	COOKIES	DATA LOCATION	EXT:FORM	POWERMAIL	GDPR CONSENT NEEDED
CAPTCHA.eu	Proof-of-work + contextual signals	No	Austria (EU)	Yes	Yes	No, for CAPTCHA layer
Friendly Captcha	Proof-of-work + global risk database	No	Dedicated EU-only endpoint from Advanced plan. Lower tiers may use global infrastructure.	Yes (v12.4, v13.4 LTS)	Yes	No, for CAPTCHA layer
hCaptcha	Image challenges + behavioral	Yes	US-based	Yes	No native support	Yes, likely
reCAPTCHA v3	Behavioral risk scoring	Yes (_grecaptcha)	US-based	Yes (via in2code/powermailrecaptcha)	Yes	Yes, likely
TrustCaptcha	Proof-of-work + dynamic challenge	No	Germany (EU)	Yes	Yes	No, for CAPTCHA layer

---

Which option fits which TYPO3 setup?

The best answer depends on what kind of site you run and how much operational complexity you want to carry long-term.

---

How to replace reCAPTCHA in TYPO3 with CAPTCHA.eu

The migration takes under fifteen minutes for most TYPO3 installations. The steps below cover EXT:form (TYPO3’s native form framework) in the main flow, with PowerMail covered separately in the next section.

composer require captcha-eu/typo3

./vendor/bin/typo3 extension:setup

---

PowerMail-specific migration

PowerMail is the most widely used third-party form extension in TYPO3, particularly in DACH enterprise and public sector deployments. If your site uses PowerMail rather than EXT:form, the installation path uses a separate package but follows the same principle.

Install the PowerMail-specific extension:

composer require captcha-eu/typo3-powermail

After installation, add your Public Key and REST Key to your TypoScript Constants:

plugin.tx_captchaeu.publickey = YOUR_PUBLIC_KEY
plugin.tx_captchaeu.restkey = YOUR_REST_KEY

Then enable PowerMail’s spam shield in your TypoScript setup and set the indication value:

plugin.tx_powermail.settings.setup.spamshield._enable = 1
plugin.tx_powermail.settings.setup.spamshield.methods.11.indication = 100

Finally, open the PowerMail form in the TYPO3 Form Editor and add a new field of type captcha.eu. The field position within the form does not affect functionality. Clear caches and test the frontend form to confirm verifications complete silently.

---

GDPR compliance checklist after switching

Switching the extension handles the technical layer. These steps complete the compliance picture for your TYPO3 site.

Confirm with your DPO or legal team. For regulated-sector TYPO3 deployments, confirm the switch with your DPO before go-live. The switch typically simplifies the compliance picture, but your DPO should confirm this aligns with your site’s specific processing documentation.

Update your privacy notice. Remove the reCAPTCHA processing description, the reference to Google as a processor, and any mention of US data transfers. Add a brief entry for CAPTCHA.eu naming Austria as the processing location and bot protection as the purpose.

Review your consent banner. If your Consent Management Platform included an entry specifically for reCAPTCHA cookies, assess whether that entry is still needed. For CAPTCHA.eu, no cookie-based consent mechanism is needed for the CAPTCHA layer itself. Other tools on your site may still require consent.

Update your processing records. Under GDPR Article 30, replace Google as the CAPTCHA-related processor in your records of processing activities. Add CAPTCHA.eu with Austria as the processing location. A standard DPA is available from CAPTCHA.eu.

---

Frequently Asked Questions

---

Related reading

This guide focuses on the migration decision and process. The articles below answer the next questions most teams have once they decide to re-evaluate Cloudflare Turnstile.

---