What is the rc::b cookie?
rc::b is a value saved by the Google reCAPTCHA script (v3 or Enterprise) in the browser's sessionStorage, not in a classic HTTP cookie. It appears on any page where reCAPTCHA is loaded – typically contact forms, login, registration, or checkout pages – as soon as Google's script (served from google.com/recaptcha or gstatic.com) runs.
It is set by Google, as part of the reCAPTCHA service embedded by the site owner, not by the site itself.
What data it stores
rc::b is part of a set of entries (rc::a, rc::b, rc::c, etc.) used internally by reCAPTCHA to collect behavioral signals about the user's interaction with the page (movements, time spent, and other technical signals), used to compute a risk score. The exact format of the value is not publicly documented by Google and may vary between versions.
The collected data is sent to Google's servers for processing and scoring; it is not directly accessible to or used by the site running the script.
What it is used for
The purpose is strictly technical: it allows Google reCAPTCHA to assess whether the interaction on the page comes from a human or an automated script, often without showing a visual challenge (v3/Enterprise work invisibly). For the site using it, rc::b helps protect forms from spam, fake accounts, and automated abuse.
Does it require consent?
In CookieFix's classification, rc::b is categorized as strictly necessary, since it supports an essential security function (form protection) and is not used for marketing or traffic analysis. Under the ePrivacy Directive (transposed in Romania via Law 506/2004) and common GDPR interpretation, strictly necessary cookies do not require prior consent.
- It must still be disclosed in the site's cookie policy, naming the provider (Google) and its purpose.
- The site owner should check whether using reCAPTCHA involves data transfer to Google in the US and disclose this in the privacy policy.
How to block or delete rc::b
A visitor can delete or block rc::b via browser settings (clearing session storage/site data) or by using extensions that block Google reCAPTCHA scripts; the effect is that the form protected by reCAPTCHA may refuse submission or require an additional check.
Because it is strictly necessary, a CMP like CookieFix does not block the reCAPTCHA script by default, but it can offer the option to load it only when the user interacts with the form, for sites that want tighter control before consent.
Frequently asked questions
No, it is classified as strictly necessary because it supports a security function (anti-spam), so it does not require prior consent, but it must still be disclosed in the cookie policy.
It stores technical signals used by Google reCAPTCHA to compute a risk score and distinguish humans from bots when forms are submitted.
It's an entry in sessionStorage, not a classic HTTP cookie, but it's treated similarly from a privacy standpoint since it stores data on the user's device.
It lasts for the current browser session only – it disappears automatically when the tab or browser is closed, since it's stored in sessionStorage.