Turnstile privacy consent

When using google reCaptcha v3 (which is invisible mostly) as site owner we should ask for users’ privacy consent, then load the captcha script.
In Turnstile introduction, it’s said that it is a privacy-preserving alternative to CAPTCHA
Does this mean as a site owner we don’t have to ask for users’ consent before loading the script?

Unfortunately this is something only a legal / privacy expert in your jurisdiction can fully answer, and Turnstile is such a new product that I haven’t seen any general universal guidance.

From the blog Turnstile has to look at some session data (like headers, user agent, and browser characteristics) which may be enough to trigger the need to request consent to collect data, but it does not use cookies which is one of the biggest cases where you need consent.

The reality is that every jurisdiction has their own idea of exactly what triggers the need for explicit consent, and exactly what data is personal so this is a tough one to answer – Sadly, if in doubt, ask first, which is the exact sort of pessimistic answer that has resulted in half the web is covered in “please may we share a cookie together before you look at our site”.


This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.