What is the rc::c cookie?
rc::c is a value saved by Google's reCAPTCHA service (v2 or v3), embedded on websites to protect comment forms, login pages, contact forms, or checkout flows from spam and automated abuse.
It typically appears as soon as a page loads the reCAPTCHA script from Google, whether through a visible widget or the invisible v3 variant, regardless of whether the visitor actively interacts with it.
What data it stores
rc::c is not a classic HTTP cookie but a sessionStorage entry, a browser-local storage mechanism that, unlike cookies, is not automatically sent to the server with every request.
It contains a technical identifier generated by the reCAPTCHA script, used to analyze behavior within the current page session. The exact value format is not publicly documented by Google and may vary between versions. Data collected by reCAPTCHA (behavioral signals, browser characteristics) is processed by Google under its own privacy policy.
What it is used for
Its main purpose is security: reCAPTCHA evaluates signals (interaction patterns, technical session characteristics) to decide whether a visitor is human or an automated bot, without constantly showing visible challenges.
For site owners, this means less spam submitted through forms, protection against brute-force attacks, and a smoother experience for legitimate users, especially with reCAPTCHA v3, which runs mostly in the background.
Does it require consent?
CookieFix classifies rc::c as strictly necessary, since it supports a security function essential to the integrity of the site's forms (anti-spam, anti-bot).
- Under the ePrivacy rules and GDPR, strictly necessary cookies do not require prior consent.
- Site owners must still disclose rc::c and its purpose in the cookie policy, along with the fact that the provider (Google) may process data outside the EU.
- It's advisable to document a clear legal basis (legitimate interest) for using reCAPTCHA.
How to block or delete rc::c
A visitor can clear sessionStorage data by clearing browser cache or using a private/incognito window; this does not break core site functionality, but may make reCAPTCHA less effective or trigger additional challenges.
Although it is strictly necessary and not consent-dependent, some site owners choose to load the reCAPTCHA script only when the user interacts with the relevant form, to reduce initial page load. Consent management platforms like CookieFix can automatically block non-essential third-party scripts until consent is given, while keeping strictly necessary ones such as reCAPTCHA active where applicable.
Frequently asked questions
Not technically; it's a sessionStorage entry, a browser-local storage area, rather than an HTTP cookie automatically sent to the server.
No, it's classified as strictly necessary because it supports anti-bot protection for forms, but it must still be disclosed in the cookie policy.
Only for the current browsing session; it disappears when the visitor closes the tab or browser.
reCAPTCHA may become less accurate or show extra challenges, but the site's core functionality remains unaffected.