What is the rc::a cookie?
rc::a is a technical entry saved by the Google reCAPTCHA script (v3, and in some implementations invisible v2) in the browser's localStorage, rather than as a classic HTTP cookie. It appears on any page where reCAPTCHA loads — typically contact forms, login, registration, or comment forms.
It's set by Google's domain (google.com / recaptcha.net) when the reCAPTCHA script initializes on the page, regardless of whether the visitor actually interacts with the form.
What data it stores
The value of rc::a is generated internally by the reCAPTCHA algorithm and contains encrypted/encoded data used by Google for behavioral analysis of the visitor (mouse movements, page interactions). The exact value format is not publicly documented by Google.
The collected data is sent to Google's servers, which process it to calculate a risk score (the likelihood that the visitor is a bot). Because it's stored in localStorage, the entry persists indefinitely, unlike a cookie with a fixed expiration date.
What it is used for
The purpose is purely technical: it allows Google reCAPTCHA to tell human traffic apart from automated bots without showing visual challenges to legitimate users. For site owners, this reduces form spam, fake sign-ups, and automated brute-force attacks.
Without this entry, reCAPTCHA cannot function properly, since the anti-bot score relies on behavioral signals accumulated over time.
Does it require consent?
Under CookieFix's classification, rc::a is categorized as strictly necessary, since it supports a security function (spam/bot protection) without which the form cannot be validated correctly. Strictly necessary cookies don't require prior consent under the ePrivacy Directive (2002/58/EC) as implemented in Romania by Law 506/2004, art. 4.
- Does not require acceptance from the consent banner before being set
- Must still be explicitly disclosed in the cookie policy, naming the provider (Google) and its purpose
- Site owners remain responsible for checking whether the data transfer to Google serves any additional purposes (e.g. advertising), which would change its classification
How to block or delete rc::a
A visitor can delete the entry from their browser via privacy/localStorage settings (e.g. in Chrome: Settings → Privacy and security → Clear browsing data → Cookies and other site data). Blocking reCAPTCHA at the browser level, however, may prevent protected forms from working correctly.
At the site level, a CMP such as CookieFix can automatically block the reCAPTCHA script from loading (and thus prevent the rc::a entry from being created) until the visitor makes a choice, if the site owner chooses to treat reCAPTCHA as optional rather than as a strictly necessary form element.
Frequently asked questions
No. It's a localStorage entry, but it's treated legally the same as a cookie under the ePrivacy Directive and Romanian data protection guidance.
Usually not, since it's considered strictly necessary for reCAPTCHA's anti-spam function, but it must still be disclosed in the cookie policy.
It's persistent, meaning it stays saved in localStorage indefinitely until manually cleared by the user or the browser.
reCAPTCHA may show additional challenges (images, checkbox) or fail entirely, which can prevent submission of protected forms.