CCPA
Designed to avoid sale or sharing of data.
Scope
SCaptcha is self-hosted and does not monetize user data. You control the limited security metadata stored for verification.
This page maps SCaptcha 2.3.0 behavior to the named framework. It is not a certification or legal advice.
No sale or sharing by default
SCaptcha does not sell or share personal information with third parties, and it does not embed marketing pixels.
Verification data remains inside your infrastructure unless you enable optional external lookups.
Minimal personal information
The widget avoids tracking cookies. Optional browser routines run only when enabled, and submitted telemetry can enter local logs. Under-Attack Mode uses a short-lived security cookie for gate access.
Logs are optional and can be disabled to reduce data collection to the minimum required for abuse prevention.
Consumer rights workflows
If you store logs, they live in your database and can be handled via your existing access and deletion procedures.
Disabling or limiting logging reduces the scope of data subject requests.
Implementation checklist
Document your security data practices, explain optional Sentinel checks, and clarify that no data is sold or shared.
Review any external lookups for CCPA notice requirements and keep retention short.
SCaptcha 2.3.0 behavior
Each challenge uses its own cryptographically random 32-byte salt. Your WoltLab installation validates the salt, hash, algorithm, answer, and HMAC against the issuing session. The challenge expires after 60 seconds and does not require an external CAPTCHA provider.
This option is off by default. If you enable it, SCaptcha sends the visitor's public IP address to proxycheck.io for proxy, VPN, or Tor evidence. SCaptcha 2.3.0 sends tag=0 by default; administrators can opt in to provider logging. The IP address is transmitted for every lookup either way.
A pre-submit marker and the optional text/audio proof are valid for 5 minutes. Under-Attack mode uses a signed, user-agent-bound access cookie for 5 to 30 minutes; the default is 10. Sentinel can store a server-side rejection in a separate signed cookie for 10 minutes. Sentinel itself is off by default.
Request analytics are on by default. Logs can contain linkable operational data, including IP address, user agent, request, network and location fields, reasons, and submitted browser telemetry. Retention defaults to 90 days and can be set from 1 to 3,650 days. Turning analytics off stops new collection but does not erase existing rows or exports.
What operators need to review
Document enabled features, limit access to security logs, and assess optional external services separately. SCaptcha does not replace legal review or accessibility testing of the complete website.
Enable only the options you need. Update privacy and cookie notices, restrict access to analytics and logs, and test the actual form integration before launch.