Cloudflare Turnstile vs hCaptcha Publisher Tier
Two free CAPTCHA options. One sells your visitors' labeling work. The other doesn't.
If you Google "free CAPTCHA alternatives to reCAPTCHA in 2026" you'll find two strong contenders at the top: Cloudflare Turnstile and hCaptcha Publisher tier. Both are pitched as free, both work as drop-in replacements for reCAPTCHA, and both have good documentation. But the way each one is "free" is fundamentally different, and the choice has consequences for your users.
How Turnstile is free
Cloudflare gives away Turnstile because it serves the larger Cloudflare business. When millions of sites run Turnstile, Cloudflare gets:
- Better threat data (every challenge attempt feeds Cloudflare's bot detection ML)
- A funnel into enterprise products (sites that grow eventually buy Bot Management, Workers, R2)
- A defensive moat (developers used to Cloudflare tooling are likelier to use other Cloudflare products)
The user's role in this exchange is solving an invisible challenge once per page. No data is monetized, no labeling work is performed, no third party receives the data.
How hCaptcha Publisher is free
hCaptcha Publisher tier is free because hCaptcha sells your visitors' image-labeling work to enterprise customers. When a visitor hits the hCaptcha widget on your site, hCaptcha may present them with an image-classification task (identify bicycles, count traffic lights, etc). The labels they produce are used to train machine learning models for enterprise customers, who pay hCaptcha for the labeling work.
Your visitor performs unpaid labor that hCaptcha monetizes. Your site receives a small revenue share (typically pennies per thousand challenges) if you opt into the Publisher Rewards program. The economics work for hCaptcha because they capture the gap between what enterprise customers pay for labeled data and what the labor costs them (zero, because visitors do it for free in exchange for accessing your site).
Why this matters
If you ship hCaptcha Publisher to your users without disclosure, you're routing them through unpaid labor for hCaptcha's customers without their consent. Most users don't notice or care, but a meaningful minority do, and the issue has surfaced in several EU consumer protection complaints. The 2024 Bavarian DPA opinion specifically called out CAPTCHA labeling as a data processing activity that requires consent under GDPR.
If you ship Turnstile to your users, the only thing you're routing them through is Cloudflare's network reputation check. The data Cloudflare collects is used to score that specific request and feed bot detection broadly. No labeling work, no third-party customer data routing, no consent question.
When hCaptcha is still the right pick
Two cases:
- You need a CAPTCHA that's not from Cloudflare for compliance or vendor diversification reasons, and you can afford the $99/mo Pro tier. hCaptcha Pro is genuinely good, no labeling work, clean privacy story.
- You actively want the Publisher Rewards revenue. For a high-traffic site (millions of CAPTCHA challenges per month), the revenue share is real money. The user disclosure problem is yours to handle, but the economics work.
For every other case in 2026, Cloudflare Turnstile is the cleaner free option. The migration takes about an hour and the privacy story improves materially.