reCAPTCHA Terms Change (Apr 2, 2026)
On this page
“reCAPTCHA is changing its terms of service” is one of those messages that makes every site owner do the same thing: stare at it, squint, and assume their forms are about to break.
The good news: this April 2, 2026 update is being positioned as a legal / compliance change, not a “reCAPTCHA is shutting down” change. The bad news: it still matters — especially if you care about GDPR language, your privacy policy, and what you’re telling users on your forms.
I’m Ben Marshall (full-stack dev + engineering manager). This guide explains what’s changing, what you should update on a WordPress site, and how to avoid turning “spam protection” into “accidentally blocked real people.”
TL;DR: What to do before April 2, 2026
- Audit your reCAPTCHA disclosures: many sites display Google Privacy/Terms language in footers, badges, or form notes (especially if you hide the badge).[4]
- Update your site language per the notice: Google’s update says Google Privacy Policy and Terms will no longer apply to your users for reCAPTCHA, and you should remove those references starting April 2, 2026.[1]
- Confirm your reCAPTCHA setup won’t fail under load: if you exceed the free allowance without billing enabled, Google Cloud docs say reCAPTCHA can return errors for new requests.[2]
- Stop relying on “challenge only” spam defense: add reputation + behavior layers so one script doesn’t decide your conversion rate.
What’s changing on April 2, 2026 (in normal human language)
Google has stated that, effective April 2, 2026, reCAPTCHA will shift from Google acting as a Data Controller to acting as a Data Processor. In the same communication, Google says Google’s Privacy Policy and Terms will no longer apply to your users for reCAPTCHA, and that site owners should remove those references starting on that date.[1]
What stays the same
According to the notice summarized publicly, the service continues and the features/functionality are not the point of the change. The “you need to update what you say + how you govern it” part is the point.[1]
Why WordPress site owners should care
WordPress sites often embed reCAPTCHA across multiple flows: contact forms, login, registration, password reset, checkout, etc. That means any policy language or disclosures can be duplicated across templates, form plugins, and “helpful” snippets someone added years ago and forgot about.
What to update on your WordPress site (practical checklist)
Not legal advice (because the internet is the internet). But here’s the real-world “don’t miss stuff” list that usually applies to WordPress implementations.
1) Update any reCAPTCHA disclosure text you show users
If you ever hid the reCAPTCHA badge, Google’s developer FAQ says you must include visible branding text that references Google’s Privacy Policy and Terms of Service.[4] That’s important because Google’s April 2, 2026 notice says those Google Privacy/Terms references should be removed starting on that date.[1]
Action: search your theme + forms for that disclosure text (and any “This site is protected by reCAPTCHA…” footer notes) so you’re not updating only one location and missing three others.
2) Review your privacy policy language around bot protection
Google’s notice is specifically about roles and terms changing. That typically triggers a privacy policy review, because what you say about data processing (and who governs it) needs to match reality.[1]
If you’re not sure what your site currently loads, the reCAPTCHA developer FAQ also notes reCAPTCHA sets a cookie named _GRECAPTCHA when executed for risk analysis, and it mentions the www.recaptcha.net domain as an option for some cookie considerations.[4]
3) If you’re in a regulated world, confirm your contracts (DPA/vendor terms)
The public notice frames this as Google acting as a processor “following your instructions,” which is the kind of phrasing that usually ties into a DPA or cloud processing addendum relationship.[1] If your organization requires vendor documentation for compliance, put this on someone’s checklist now instead of on April 2.
4) Make sure your forms won’t fail when traffic spikes
Separate from the April 2 legal shift, Google Cloud’s reCAPTCHA billing docs are very direct: if you don’t enable billing and you reach the free monthly allowance, reCAPTCHA can return an error for any new request after you hit the limit.[2]
If your contact form is revenue-critical, “oops our reCAPTCHA quota got weird” is not the vibe. (If you want the full breakdown, this pairs nicely with the reCAPTCHA pricing post we did right before this.)[2]
A better spam strategy (so one widget doesn’t decide your conversions)
Even when reCAPTCHA is configured perfectly, challenges are still just one layer. The best long-term setups filter repeat offenders before you ever get to the challenge step: IP + email reputation, disposable email filtering, and behavioral signals.
Where Zero Spam fits
Zero Spam for WordPress is built around layered defense and integrates with reputation sources (including Stop Forum Spam and Project Honey Pot) so most junk gets blocked quietly in the background.[5]
If you want stronger filtering with fewer false positives — especially for lead forms, quote requests, and support — a Zero Spam API license adds confidence scoring and additional intelligence so you can tune strictness without guessing.[6]
And yes, keep this handy: use code ZEROSPAM20 for 20% off a Zero Spam License.[7]
Frequently Asked Questions
The change shifts Google’s role from data controller to data processor for reCAPTCHA. The site owner becomes the data controller for reCAPTCHA usage. The update changes which terms apply to users interacting with your forms.
You should review any reCAPTCHA disclosures shown on your site. You should remove references to Google’s Privacy Policy and Terms where the notice requires it. You should update your privacy policy language so your reCAPTCHA description matches the new roles.
The notice describes a legal role change rather than a shutdown. The service continues according to the public communication. Your site still needs correct keys and a working script load for verification to pass.
reCAPTCHA can return errors for new requests after you reach the free monthly allowance without billing enabled. Google Cloud billing documentation describes this behavior explicitly. Billing setup prevents protection failures during traffic spikes.
Layered defense reduces spam without forcing every visitor through a challenge. Reputation checks block repeat offenders before a challenge runs. That approach reduces false positives and protects conversions.
Sources & References
- Google Cloud Security (LinkedIn post summarizing Apr 2, 2026 controller → processor shift; “Google’s Privacy Policy and Terms will no longer apply”; remove references)
- Google Cloud reCAPTCHA billing info (errors after free allowance without billing; pricing behavior)
- Google Cloud migrate from reCAPTCHA Classic (billing required for migration; Enterprise API context)
- Google reCAPTCHA developer FAQ (cookie notes; badge/branding disclosure snippet)
- Zero Spam for WordPress (feature overview; reputation integrations)
- Zero Spam API pricing (confidence scoring and intelligence)
- Zero Spam discount page (promo code ZEROSPAM20)
- Heise reporting on the Apr 2, 2026 shift (context + summary of change)
