Since the first days of the internet, content creators have struggled to distinguish bot traffic from human traffic.
In 2000, a student named Luis von Ahn invented the CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart), which limited spam by requiring users to prove their humanity. The problem: The test didn’t work for all types of humans, particularly people with vision or hearing disabilities.
Traditional CAPTCHAs asked users to translate distorted images of text or listen to garbled audio files. That was a nightmare for accessibility — and in 2008, Version 2.0 of the Web Content Accessibility Guidelines (WCAG) introduced a requirement that essentially prohibited classic CAPTCHAs.
Today, we have other options for human verification. One solution is Google’s reCAPTCHA version 2 (v2), which asks the user to select a checkbox that states “I am not a robot.”
Many of our clients have asked whether reCAPTCHA fulfills WCAG requirements (and by extension, whether the widget complies with laws like the Americans with Disabilities Act). The answer is a resounding “sort of.”
If you’re considering reCAPTCHA v2, here’s what you need to know.
reCAPTCHA v2 fulfills WCAG, but it still creates problems for users with disabilities
WCAG’s very first success criterion requires text alternatives for all non-text content. That requirement includes several exceptions, including one that specifically discusses CAPTCHA:
If the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.
In its standard implementation, reCAPTCHA v2 fulfills this requirement. The checkbox is clearly labeled, and if the widget detects unusual activity, human users may still be presented with an image or audio verification test.
However, reCAPTCHA v2 can still create accessibility issues. Some users may have trouble moving their cursor to complete the checkbox, and if the query resolves to a “challenge,” the user may have trouble completing that challenge.
Users are also more likely to receive sensory challenges if they disable third-party cookies — and many people who use screen readers and other assistive technologies may take that step to improve compatibility.
Perhaps most importantly, reCAPTCHA v2 isn’t as effective as it once was: In 2019, researchers from the University of Louisiana at Lafayette created an application that they claimed could bypass reCAPTCHA v2’s image recognition tests with a 92.4% success rate.
If you must use a CAPTCHA, reCaptcha v2 is an acceptable option — but it isn’t perfect, and it may not divert bot traffic. Fortunately, there are alternatives that work more effectively while improving accessibility.
Related: Why Visual CAPTCHA is a Major Barrier for Screen Readers
Human verification tools shouldn’t request information that the user cannot provide
The best approach is to avoid interrupting your users. Technologies that utilize back-end processing and logic can help you maintain a consistent user experience, and they’re generally better for accessibility.
Google’s reCAPTCHA v3 is a more robust solution that analyzes user behavior to determine whether or not they’re real humans. It’s likely much more effective than v2, and crucially, it doesn’t present people with challenges that they cannot complete.
Other options include hCaptcha, a privacy-focused solution that uses machine learning to distinguish humans from bots. hCaptcha is available for web and mobile platforms.
Challenge-free CAPTCHA alternatives rely on widgets, but many are fully compliant with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act of 2018 (CCPA), and other consumer privacy laws.
And since these solutions don’t interrupt users, people have more time to spend on your website. One analysis from Cloudflare found that users take an average of 32 seconds to complete a CAPTCHA challenge — that’s a lot of time to spend on an inherently frustrating task.
If you’re ready to adopt the best practices of accessibility, we’re here to help. For guidance with a specific accessibility concern, send us a message to connect with a subject matter expert.
