Invisible reCAPTCHA — How It Works and When to Use It

<!-- Invisible reCAPTCHA v2 (badge variant) -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

<form id="contact" action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />

  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>

  <button
    type="submit"
    class="g-recaptcha"
    data-sitekey="YOUR_SITE_KEY"
    data-callback="onSubmit"
    data-size="invisible"
  >
    Send
  </button>
</form>

<script>
window.onSubmit = function (token) {
  // token is the reCAPTCHA response — verify server-side
  document.getElementById("contact").submit();
};
</script>

<!--
The reCAPTCHA badge appears in the bottom-right corner of every page.
Google requires it OR a privacy-policy mention of reCAPTCHA usage.
-->

Invisible reCAPTCHA comes in two flavors. (1) reCAPTCHA v2 invisible: a badge in the page corner, the CAPTCHA fires only when the user clicks submit, no visible challenge for most users (but falls back to an image puzzle for suspicious sessions). (2) reCAPTCHA v3: always-on background scoring, never shows a puzzle, returns a score the developer interprets.

v2 invisible is good for low-volume forms where you want a fallback puzzle for borderline cases. The badge is visible (legal requirement unless you add a privacy-policy notice), but for most users the experience is 'click submit, form goes'. The fallback puzzle only fires for users Google's algorithm flags as suspicious.

v3 is good for high-volume forms where any visible friction tanks conversion. No badge required (just the privacy mention), no puzzle ever, just a score from 0.0-1.0. The cost is more behavioral data harvesting and a thresholding problem — pick too high and you block real users; too low and bots get through.

Both flavors are still reCAPTCHA — Google harvests behavioral data, the script is ~600KB, and there are accessibility concerns when the fallback puzzle fires. For most contact forms, a honeypot + backend AI classifier (splitforms ships both) is the better tradeoff: no badge, no script, no fallback puzzle, no privacy concerns. Reach for invisible reCAPTCHA only when you have evidence the simpler layers don't catch your specific spam.

Invisible to most, fallback puzzle for some. Still harvests data.