No products in the cart.
Is CAPTCHA Solving Legal? What the Law Actually Says
Nothing in US, UK or EU law names CAPTCHA solving as an offence. There is no statute against it, no case that turns on it, and no regulator that treats the act itself as wrongdoing. So when someone asks is CAPTCHA solving legal, the honest answer is that the question is about something else: what you did with the access, whose contract you agreed to first, and what data you took. This post walks through where the line actually sits, using the cases that drew it. It is written by developers, not lawyers, and it is not legal advice.
The short answer, and why it is short
A CAPTCHA is a test, not a lock. It asks whether the visitor is a person and it lets everybody through who passes. It does not authenticate anyone, it grants no permissions, and it protects no secret. Passing one gets you exactly what any anonymous visitor already had.
That distinction is why the legality question keeps collapsing into other questions. Circumventing a technological measure that protects a copyrighted work is its own offence in many places. A CAPTCHA is not that. Getting into an account that is not yours is an offence nearly everywhere. A CAPTCHA is not a login either. Strip both away and what remains is ordinary automated browsing, which is legal, common, and how most of the web gets indexed.
Terms of service are a contract, not a criminal statute
Most sites forbid automated access somewhere in their terms. Breaking that promise is a contract problem. It gets you banned, and it can get you sued by the site. It does not by itself make you a criminal, and two decisions in the United States have made that increasingly clear.
Van Buren v. United States, decided in 2021, read the Computer Fraud and Abuse Act narrowly. Exceeding authorised access means reaching parts of a system that are closed to you, not misusing information you were already allowed to see. Violating a policy about how you use data is not the same as hacking.
hiQ Labs v. LinkedIn went the same direction in the Ninth Circuit, which held that scraping data a site publishes to the whole world is unlikely to be access without authorisation, because nothing was ever restricted. That case is also the cautionary half of the story: hiQ won the computer crime argument and later lost on breach of contract, then settled under an injunction. The scraping was not a crime. The agreement it broke still had teeth.
So the useful test is not whether a challenge stood in the way. It is whether the content was public, and whether you accepted an agreement before you took it. Our own terms of service say the same thing from the other side: the tool is licensed for lawful use, and the responsibility for the target site sits with the person automating it.
The line that matters: public page or gated account
One question separates almost every safe case from every risky one. Is the CAPTCHA standing in front of something anyone can see, or in front of an account?
| Situation | What the challenge guards | Risk profile |
|---|---|---|
| A public product listing behind an anti-bot check | Nothing private, everyone gets through | Contract risk at most |
| Your own staging or test environment | Your system, your permission | None |
| A form you own, exercised by an end to end test | Your system again | None |
| Login, paywall or a members area you have no account for | An authentication boundary | Potentially criminal |
| Bulk account creation or credential stuffing | Identity and other people’s data | Criminal in most places |
| Buying event tickets faster than the queue allows | A federal statute in the US | Expressly unlawful |
That last row is worth naming. The Better Online Ticket Sales Act of 2016 makes it unlawful in the United States to circumvent a security measure or access control system on a ticket seller’s site in order to buy more tickets than the rules allow. It is the closest thing to a law about defeating a bot check, it is narrow on purpose, and it applies to ticketing rather than to the technique.
Outside the United States
The shape is similar and the vocabulary changes. The UK Computer Misuse Act 1990 turns on unauthorised access to a computer, which again points at accounts rather than at challenges. EU member states implement the directive on attacks against information systems with the same core idea. Nowhere does the CAPTCHA appear as the operative fact.
What does travel across all of them is data protection. If the pages you collect contain personal data, the GDPR applies to what you gathered no matter how you reached it, and no anti-bot check was ever the thing making that lawful or unlawful. Database rights in the EU and UK add a second, separate question about extracting substantial parts of a structured collection. Both are worth more of your attention than the challenge in front of them.
The uses nobody argues about
Plenty of CAPTCHA solving is uncontroversial, and it is most of what our users do:
- Testing your own forms, because an end to end suite that cannot get past your own signup page is a suite with a hole in it
- Monitoring a site you operate, where a synthetic check has to complete the same journey a customer does
- Accessibility, where an image or audio challenge is a barrier rather than a test, and solving it on your own behalf is the workaround the format forces rather than a loophole
- Authorised security work, where a scope document already says which systems you may reach
- Research and archiving on public material, on whatever terms the publisher sets
That accessibility point is not folklore. The W3C has catalogued the problem across two decades of revisions in its working group note on CAPTCHA inaccessibility, and audio alternatives have never closed the gap for everyone.
These are also the cases where an unmetered solver changes the engineering rather than the legality: a test suite that retries is only reasonable when a retry is free. The practical trade-offs between approaches are laid out in our comparison of CAPTCHA solving services.
Where running it locally genuinely changes your position
This is the part that is a compliance question rather than a criminal one, and it gets skipped a lot.
A cloud solving API works by receiving your data. Depending on the challenge that can mean the page URL, the sitekey, a screenshot of the form, the user agent and sometimes session material. You are sending it to a third party, usually in another country, often to be looked at by a human worker. Under the GDPR that is a processor relationship and quite possibly an international transfer, and it needs a contract, a lawful basis and a record. Human powered solving farms carry a second question about the people doing the work.
A solver that runs on your own machine has none of that. The page data never leaves your infrastructure, so there is no transfer, no processor, and nothing to disclose in a data map. That holds for Server mode too: pointing the solver at your network or public IP so a VPS or a CI runner can reach it moves the process onto another box you own, and the connection settings cover both modes. It is still your hardware, so the data still never leaves your estate.
Frequently asked questions
Does breaking a site’s terms of service make me a criminal?
Generally no, at least in the United States after Van Buren. It makes you a party who broke an agreement, which exposes you to being banned or sued rather than charged. That is still a real risk and it is the one most scraping disputes actually turn on, so read the terms before you build against a site rather than after.
Is solving a CAPTCHA on my own site allowed?
Yes, without qualification. You own the system, you set the rules, and an automated test that completes your own signup flow is no different in kind from any other test. If the widget is yours, turning it off with a feature flag in staging is usually simpler still. Solve it when staging has to mirror production exactly, or when the challenge path is the thing under test.
Is scraping public data legal if a challenge is in the way?
The challenge is not what decides it. Courts have looked at whether the data was public and whether you agreed to terms, and an anti-bot check has not been the operative fact in the leading cases. Personal data brings the GDPR into it separately, and copyright or database rights can apply to the content itself. Those three questions are the ones to answer.
Do you police what customers solve?
We cannot, and that is a direct consequence of the design. The solver runs on your machine and reports nothing back, so there is no queue of jobs here to inspect. The licence sets the boundary instead. Our FAQ covers what the software does and does not send anywhere.
The short version
No law names the act. Ask three questions instead: was the content public, did you accept an agreement, and does what you collected contain personal data. Those decide the outcome, and a challenge standing in the way changes none of them.
Where the technical choice does matter is disclosure, because a cloud service is a third party receiving your data and your own local captcha solver is not. If you are building automation against public pages, our web scraping page covers the patterns and the etiquette that keep you on the right side of it. For anything with real money or real exposure attached, ask a lawyer in your jurisdiction. This post is a map, not advice.