关于reCAPTCHA向谷歌传输的数据及相关技术问题咨询
Let's break down your questions clearly—this is info I've picked up from implementing reCAPTCHA on multiple projects and reviewing Google's documentation:
1. Data Collected by Invisible reCAPTCHA & Sending Frequency
Invisible reCAPTCHA collects two main types of data, sent at different times:
- Environment baseline data: IP address, user-agent string, browser/OS version, screen resolution, installed browser plugins, and network latency metrics. This is sent once immediately when the page loads (as soon as the reCAPTCHA script initializes).
- Interaction behavior data: Mouse movement paths, click timing/duration, scroll patterns, and touch gestures (for mobile users). This is sent when you trigger the verification flow (e.g., clicking a form submit button protected by reCAPTCHA). If the system needs more data to confirm you're human, it may send small, incremental snapshots of your behavior while you interact with the page.
- Contextual data: The URL of the page where reCAPTCHA is embedded, plus any custom
actionparameters set by the site. This is sent alongside the interaction data during verification.
2. User Events Captured by reCAPTCHA
reCAPTCHA tracks a variety of user interactions to build a "human behavior profile" for verification:
- Mouse events: Movement speed, path smoothness, click coordinates, and time between clicks.
- Touch events: Tap location, swipe direction/speed, and multi-touch gesture patterns (if used).
- Scroll events: Scroll speed, direction changes, and pause points on the page.
- Page engagement events: Time spent on the page before triggering verification, order of element clicks, and window focus changes (like switching browser tabs).
3. Non-User Behavior Data Unrelated to Verification?
From what I've gathered from Google's reCAPTCHA privacy guidelines and implementation details:
Google does not collect data that's entirely unrelated to the verification purpose. Any non-user-behavior data (like browser language, system timezone, or network type) is used to add context to the verification—for example, a user accessing the site from a region with high bot traffic might trigger more scrutiny.
That said, if you're logged into a Google account while interacting with reCAPTCHA, Google's broader account data policies may apply, but reCAPTCHA itself doesn't intentionally gather unrelated data like your browsing history on other sites or personal information beyond what's needed for verification.
内容的提问来源于stack exchange，提问作者Tiago Romero Garcia
