Pitfall 1: No privacy policy update = non-compliance
The mistake: Deploying hCaptcha without updating your privacy policy to disclose Intuition Machines as a data processor or explaining what IP/browser data is collected.
Why it happens: Developers treat hCaptcha as "just a security widget" and forget it's a third-party data processor. hCaptcha's website emphasizes privacy-friendliness, which can lull operators into skipping disclosure.
Consequence: GDPR enforcement action (data subjects have no transparency), CCPA liability for undisclosed collection, and reputational damage if users discover an undisclosed third party received their IP. Regulators (e.g., UK ICO, California AG) specifically flag missing processor disclosures during audits.
Pitfall 2: Missing or unsigned Data Processing Agreement (DPA)
The mistake: Using hCaptcha without a signed DPA or processor agreement with Intuition Machines, treating it as a "service" rather than a data processor.
Why it happens: Small teams assume hCaptcha is a "service" like Stripe and don't seek a formal DPA. hCaptcha does not loudly advertise DPA requirements.
Consequence: Direct GDPR Article 28 violation; the Austrian DPA and similar bodies have penalized companies for missing processor agreements. Without a DPA, you cannot demonstrate "appropriate safeguards" under GDPR Article 32, and liability falls entirely on you if hCaptcha mishandles data.
Pitfall 3: Misaligned consent categories in consent banners
The mistake: Bucketing hCaptcha under "Marketing" or "Analytics" instead of "Functional" or "Security" in your cookie/consent tool, or failing to auto-load hCaptcha on pages that do not require it.
Why it happens: Consent banner tools default to broad categories; operators do not review whether hCaptcha should fire before consent is given.
Consequence: If hCaptcha is miscategorized, you may load it without valid consent. GDPR recital 32 permits security measures without consent, but only if strictly necessary; misconfiguration looks like intentional consent-dodging. Regional DPAs (France CNIL, Germany BfDI) routinely flag this in audits.
