A reCAPTCHA alternative with no cookies: ALTCHA on PrestaShop

Two scenes you have probably lived. One: you open your inbox in the morning and there are forty messages from your contact form offering you web positioning in strange English. The other: an annoyed customer calls because they have spent ten minutes pointing at traffic lights in photos and the site will not let them write to you.

Both come from the same place: the system you use to tell people from automated programs.

What the usual captcha actually does

Google's captcha works, nobody disputes that. What hardly anyone mentions is what it does underneath in order to work:

• It asks Google whether your visitor looks human. To do that it sends over their details: where they are connecting from, how they move around the page, what they did before.
• It sets cookies, so it goes into your cookie notice, your privacy policy and the list of companies you share data with.
• Sometimes it gets it wrong. And when it does there is no appeal: the customer simply cannot send you the form and leaves thinking your site is broken.
• And the photo version is tiring. It nearly always lands on people with a poor connection, people browsing from work, or people who are not that comfortable with this sort of thing.

For a small shop those are annoyances. For a shop that prides itself on looking after its customers' data, it is a contradiction sitting on its own contact page.

The alternative, without the jargon

Instead of investigating who you are, ALTCHA gives the browser a small calculation, a pointless little sum that has to be solved before the form can be sent. You do nothing and notice nothing: it takes the blink of an eye.

The trick is on the other side. For somebody sending fifty thousand automated messages a day, that blink gets multiplied by fifty thousand, and the business stops paying off.

The idea is simple: make sending a form free for a person and expensive for a machine.

And all of it happens between your site and the visitor's browser. Nobody is asked anything, no data leaves your shop, and there is no service to sign up to.

What the person writing to you sees

A checkbox that ticks itself while they fill in the form. By the time they press send, it is done. No photos, no traffic lights, no «try again».

And no judgement about them either: somebody on a slow connection or with a heavily protected browser gets through like everyone else, just a fraction of a second later.

What you get rid of

This is the part that usually decides it, and it has nothing to do with spam:

• One thing fewer in your cookie notice.
• One company fewer on the list of who you share your customers' data with.
• And no explaining to do about data travelling outside Europe just because you have a contact form.

If on top of that your shop collects company details at signup, this stops being a preference of yours and becomes a selling point.

What it actually stops

Let us be honest, because a lot of smoke gets sold here. This stops ordinary automated spam dead: the programs that crawl the internet filling in every form they find. Which is, by a distance, most of what reaches you.

It is one more layer, and it goes where it pays off most: contact, customer signup, password recovery and newsletter.

Switching takes very little

Our ALTCHA module installs, you pick which forms to protect and that is it: no touching the shop design and not one more line in your cookie notice.