What is the _GRECAPTCHA cookie?
This cookie is set by Google reCAPTCHA to perform risk analysis and distinguish between human users and bots for fraud prevention.
Table of Contents
About _GRECAPTCHA
| Vendor | |
|---|---|
| Cookie Domain | google.com,recaptcha.net |
| Category Category The functional category of the technology, such as Web Analytics or Social Media. Learn more | Site Infrastructure & Security |
| Consent Category Consent Category The consent category this cookie most commonly falls under across sites we scan, normalized into four standard categories. Learn more | Strictly Necessary |
| Prevalence | Very Common |
| Popularity Popularity Popularity is calculated from our dataset of 4.5B+ cookies analyzed across hundreds of millions of web pages. Learn more | Found on 12.2% of scanned pages |
| Expiration Type | Timestamp |
| Expiration Duration | 27 days |
| Party Type Party Type Whether the cookie is first-party or third-party. Learn more | 3rd-Party |
| Risk Level Risk Level Rates how sensitive the data stored by this cookie is (High, Medium, or Low) based on data classification and distribution. Learn more | Medium |
| Vendor Privacy Policy | https://policies.google.com/privacy |
| Vendor Website | https://www.google.com/ |
What is the purpose of _GRECAPTCHA?
The _GRECAPTCHA cookie is deployed by Google (which acquired the reCAPTCHA technology in 2009) when the reCAPTCHA or reCAPTCHA Enterprise service is executed on a website. Its primary purpose is to provide advanced risk analysis by assessing user behavior, network patterns, and device interactions on the page. This analysis allows the system to accurately differentiate legitimate human traffic from malicious bots and automated scripts.
The cookie contains an encrypted token that captures the user's security context during the session. This information is evaluated by Google's backend servers to generate a risk score, which the host website utilizes to decide whether to block, challenge, or allow the request, such as a form submission or login attempt.
What are the Privacy Risks of _GRECAPTCHA?
Risk Level: Medium
Although this cookie is used primarily for security and bot prevention, it captures detailed behavioral signals, hardware metrics, and network information to generate a user fingerprint. Because this data is collected by Google and transmitted back to its servers, it has the potential to be correlated with other Google services or used for profiling, especially if the site relies on the standard www.google.com domain rather than the privacy-focused www.recaptcha.net endpoint.
How to Remove _GRECAPTCHA from a Website
To remove this cookie, the website administrator must locate and remove the Google reCAPTCHA scripts or integrations from the website's source code and form configurations. If reCAPTCHA is bundled within a third-party plugin (such as a contact form or security plugin in a CMS), the site administrator will need to disable the reCAPTCHA integration in the plugin's settings or remove the plugin entirely. Because this cookie is strictly required for reCAPTCHA's risk analysis to function, it cannot be disabled independently of the service itself. Alternatively, administrators can configure reCAPTCHA to serve from www.recaptcha.net instead of www.google.com to prevent other general Google tracking cookies from being set, though the _GRECAPTCHA cookie itself will still be dropped.