How Google uses reCAPTCHA to track users and earns billions from it

The popular bot protection system reCAPTCHA, owned by Google, has essentially turned into a global user tracking tool, generating massive revenue for the company. According to Boing Boing, citing research by Chuppl, Google earns approximately $888 billion per year solely from data collection via cookies.

How Does reCAPTCHA Track Users?

Originally developed in 2007 by Luis von Ahn to help digitize old books and newspapers, reCAPTCHA was acquired by Google in 2009 and used to improve Google Books and Street View. However, by 2025, experts note that bots can now easily bypass reCAPTCHA's protection—yet Google continues to implement it, as it has become a key tool for collecting user data.

According to Chuppl researchers, reCAPTCHA creates a pixel-level fingerprint of a user's browser and tracks their online activity in real time.

Former cybersecurity expert Andrew Searles from the University of California, Irvine, confirms that Google gains access to every interaction a user has on a webpage. In his study “Dazed & Confused”, he concluded that the system is less about protecting websites from bots and more about gathering data on users.

What Data Does Google Collect?

The research found that reCAPTCHA analyzes:

• Cookies
• Browsing history
• Browser parameters, including canvas rendering
• Screen resolution
• Mouse movements
• User-agent data (information about the user’s device and system)

This data allows Google to precisely track user activity and at the very least, use the information for personalized advertising.

How Much Time Do People Lose Due to reCAPTCHA?

An analysis of 3,600 users revealed that solving image-based reCAPTCHA challenges takes 557% longer than simply checking a box. As a result, in 2024, people spent 819 million hours solving these challenges, leading to an estimated $6.1 billion in lost earnings.

Meanwhile, Google continues to make huge profits by tracking users and selling their data to advertisers, raising doubts about whether reCAPTCHA's original purpose—bot protection—is still its primary function.