Does reCAPTCHA work in China?
Whether you can use reCAPTCHA for mainland-China visitors is a cross-border personal-data question first, not only a speed one. reCAPTCHA is a Google service that, by design, sends each visitor's signals to Google for analysis — so the exposure is legal as much as practical, and it outlasts the usual workaround.
By Google's own reCAPTCHA Terms of Service, the API "works by collecting hardware and software information … and sending that data to Google for analysis," and Google says it is the site owner's "responsibility to provide any necessary notices or consents" for sharing it. Because that data goes to Google outside the mainland, it is a cross-border transfer of personal information that PIPL governs — needing notice, separate consent and a transfer mechanism, with in-country storage once you are a CIIO or large-volume handler. Google even tells developers to load the recaptcha.net domain "when www.google.com is not accessible," but that swaps the domain, not the destination. The table below is Google's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and role, and on whether the widget loads at all. Our China team can map your exposure with you →
What actually decides whether you can use reCAPTCHA in China
| Fact | Primary source |
|---|---|
In Google's own reCAPTCHA Terms of Service: the API "works by collecting hardware and software information, such as device and application data and the results of integrity checks, and sending that data to Google for analysis," and Google states it is the site owner's "responsibility to provide any necessary notices or consents for the collection and sharing of this data with Google." reCAPTCHA also sets a cookie (_GRECAPTCHA) "for the purpose of providing its risk analysis." | Google — reCAPTCHA Terms of Service and reCAPTCHA FAQ, retrieved 2026-10-07 |
| Google's own reCAPTCHA FAQ instructs developers to "use www.recaptcha.net in your code in circumstances when www.google.com is not accessible" — Google acknowledging that reCAPTCHA's own domains can be unreachable for a site's users. recaptcha.net is Google's own alternate domain for the same service, so switching to it changes where the widget is requested, not the fact that visitor data is sent to Google abroad (21YunBox inference). | Google — reCAPTCHA FAQ, retrieved 2026-10-07 |
| Because reCAPTCHA sends visitor data to Google outside mainland China, PIPL treats it as a cross-border provision of personal information: the handler — the site operator, not Google — must give notice, obtain separate consent, and satisfy one of its mechanisms (a CAC security assessment, the CAC standard contract, certification, or another permitted basis). | PIPL Chapter III, Articles 38–40 (cross-border provision of personal information) |
| The exposure scales with volume and role, not with merely using the tool: since the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. For a CIIO or large-volume handler, personal information collected in China must be stored in the mainland (CSL Article 39 (formerly Article 37); PIPL Article 40) — and Google runs no mainland-China region, so reCAPTCHA offers no in-country option (21YunBox inference). | CAC — Provisions on Promoting and Regulating Cross-border Data Flows, March 2024; CSL Article 39 (formerly Article 37); PIPL Article 40 |
Measured from inside mainland China, reCAPTCHA did not answer. Requested directly from a probe inside the mainland (Alibaba Cloud cn-zhangjiakou) on 2026-08-28, www.google.com/recaptcha produced no response in three of three attempts; sampling it every ten minutes for twelve hours the same day returned zero successful responses out of 72 attempts, at every hour including the evening peak. A widget that never loads means the submit button never activates. Serving a verification step reachable inside the mainland is the delivery fix, and that is the same act that brings the ICP filing into scope. | 21YunBox — China delivery measurement, measured from inside mainland China (probe: Alibaba Cloud cn-zhangjiakou), 2026-08-28 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the first question about reCAPTCHA is not how clever its bot-scoring is — it is whether the widget even arrives, and where the data it collects ends up. reCAPTCHA is a Google service: the visitor’s browser pulls a small script from Google-operated domains before any check can run, and inside the mainland those are exactly the domains that behave unreliably. When the script never loads, the challenge never renders and the submit button it guards never activates, so a form that works everywhere else quietly fails for your Chinese users.
And in the cases where it does load, it keeps sending each visitor’s signals to Google’s servers abroad — which turns a bot-check into a cross-border data question. Reachability is the symptom you notice first; the data path is the exposure that stays even after you work around the first one.
reCAPTCHA in China at a glance
| What decides it | What a China-facing site runs into |
|---|---|
| Does the challenge load? | reCAPTCHA's script is fetched from Google-operated domains; requested from inside the mainland, those calls went unanswered in our measurement, so the widget — and the submit button behind it — never appears. |
| Where do the signals go? | By Google's own terms the service collects device and software data and sends it to Google for analysis, on servers outside the mainland. |
| Which law it triggers | Moving that personal information offshore is a cross-border transfer under PIPL; notice, separate consent and a transfer mechanism fall on you, the site operator, not on Google. |
| In-country data option? | None — Google runs no mainland-China region for reCAPTCHA, so there is nowhere in-country to keep the data if in-country storage is required of you. |
Does the recaptcha.net swap fix it? |
It changes the request domain, not the data's destination — it can help the widget load, but the cross-border question is untouched. |
| Is there a workable path? | Yes — assess the transfer for your data volume and role, and serve a verification step that is reachable and filed inside the mainland. |
When the challenge never loads, the form never submits
Every flavor of reCAPTCHA — v2, v3, Enterprise — starts the same way: the visitor’s browser has to fetch a small Google-hosted script before any check can run. That script lives on Google-operated domains, and inside the mainland those are the links in the chain that misbehave. Requested directly from a probe inside mainland China, reCAPTCHA’s endpoint did not answer on any attempt in our measurement (see the evidence above and the full China-reachability data).
When the script never arrives, no token is ever issued — so client-side validation keeps the submit button inert, or your server rejects an empty token. The form looks perfectly normal and simply will not go through. This is the failure you notice first, because your Chinese users feel it immediately, and it is the half of the problem that is purely about access: the service has to be reachable before anything else about it matters.
Even when it loads, the signals leave the country
Reachability is only the half of the problem you can see. reCAPTCHA earns its bot score by watching the visitor — Google’s own terms describe a service that collects device and software data and sends it to Google for analysis — and Google’s servers sit outside the mainland. Under China’s Personal Information Protection Law, moving a mainland visitor’s personal information offshore is a cross-border transfer, and the obligations land on the handler: you, the site operator, not Google. You owe notice, you owe separate consent, and you have to clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.
The weight of that scales with how much personal information you move and with your role. Lighter, lower-volume, non-sensitive transfers may sit under a narrower set of obligations, while a critical information infrastructure operator or a large-volume handler faces in-country storage that an offshore Google service cannot provide. Unlike the loading problem, this one does not go away on a good network day — it is the exposure that outlasts any reachability workaround.
”Just point it at recaptcha.net” fixes loading, not compliance
Google itself anticipates the reachability problem. Its reCAPTCHA FAQ tells developers to use recaptcha.net “in circumstances when www.google.com is not accessible” — a useful admission that Google’s own domains can be unreachable for a site’s users, and the alternate domain can indeed get the widget to render where the default one will not.
But recaptcha.net is still Google’s service. The visitor’s signals still travel to Google’s servers abroad, so everything in the section above is unchanged. Swapping the domain answers “does it load?” and leaves “where does the data go?” exactly where it was. Reading “it loads now” as “it’s compliant now” is the trap this page exists to flag: the delivery workaround and the compliance exposure are two different problems, and fixing one does nothing to the other.
This is a risk map, not a verdict. Whether you face cross-border-transfer duties, in-country storage, or both turns on what you collect, how much of it, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a reachable, filed verification path
You do not have to rip reCAPTCHA out, and you do not have to rebuild your forms. What a client-side Google script cannot give a China-facing site, we add around it: a bot-verification step that actually loads for mainland visitors, served from inside the mainland — and serving it in-country is the same act that brings an ICP filing into scope. In parallel, our China compliance team maps the cross-border-data exposure of whatever signals you keep collecting, against your entity, your role, and your data volumes, so the verification you run rests on a lawful basis rather than an untested one. Your application stays where it is; the China-facing gap is closed with a compliant layer in front of it, not a migration.
Related reading:
