CAPTCHA accessibility: a public-facing form should never carry one.

If your organization serves the public, your forms are not a conversion funnel. They are how a resident applies for a permit, a patient reaches a clinic, a supporter gives, a student asks for help. The people a CAPTCHA turns away are the people those forms exist for, and the obligation to reach them is written into law rather than left to preference.

We sell an alternative, so read this with that in mind. Every claim below is quoted from or checked against a named primary source, with a link. The section on what the law does not say is there because compliance officers have heard the overstatements, and the case does not need them. None of this is legal advice.

What the standards body says

The W3C's Accessible Platform Architectures Working Group maintains a note titled Inaccessibility of CAPTCHA. Its current edition is a Group Draft Note of December 2021, which is the working group's position rather than a W3C Recommendation, and its abstract puts the problem in one sentence:

Not badly built CAPTCHAs: the task itself. The same note states the working group's preference without hedging — "All else being equal, we prefer non-interactive approaches because these pose no accessibility challenges" — and records that whenever an interactive CAPTCHA is used, "a variety of alternative challenges must be made available to engage different sensory and cognitive capabilities of the user." It also reaches a conclusion about security that a public body cannot ignore: traditional CAPTCHA "is increasingly insecure and arguably now ill suited to the purpose of distinguishing human individuals from their robotic impersonators."

For what WCAG itself requires of a CAPTCHA, and where implementations fail it, see is reCAPTCHA accessible? This page takes that as read and asks the next question: given all of this, why run one at all?

It is measured, not asserted

The standards position is backed by people who were asked, and by people who were tested.

• Screen reader users rank it the worst barrier on the web. WebAIM's Screen Reader User Survey #10, with 1,539 respondents in December 2023 and January 2024, asked which items on web pages were most problematic. CAPTCHA came first, and the survey's own summary is that "CAPTCHA remains the most (by a notable margin) problematic item indicated by respondents."
• Users with learning disabilities fail more and resent it more. Gafni and Nagar (2016) put five CAPTCHA types in front of 212 users, 60 of them with learning disabilities. Those users had "more difficulties in solving the tests, especially those with distorted texts," and "more negative attitudes towards the CAPTCHA tests." Their speed was no different: the barrier is failure, not slowness, which is why it never shows up in a timing metric.
• The audio fallback is the weakest part. Bursztein and colleagues' large-scale evaluation at IEEE Symposium on Security and Privacy (2010) covered more than 318,000 CAPTCHAs across 21 schemes and found audio CAPTCHAs particularly problematic, and non-native English speakers slower in general and less accurate on English-centric schemes. The accommodation offered to the users who most need one is the version that works least well.

Who a CAPTCHA excludes

The groups below are the ones the sources document, with the CAPTCHA type each is tied to. The barriers for attention, memory and executive function are described by function rather than by diagnosis, because that is how the W3C describes them and because no study recruits participants by those diagnoses. Motor impairment is widely reported for small tiles and sliders but is not in these particular sources, so it is not in this table.

The W3C adds that a design expecting multiple attempts "as a matter of course" is "arguably inaccessible by design" not only for anxiety disorders but for "many living with a range of other cognitive and learning disabilities." Offering two versions of a test narrows the set of people excluded. It does not empty it.

It no longer does the job

A control that excludes people might still be defended if it worked. The most thorough recent measurement says it does not. Searles and colleagues' An Empirical Study & Evaluation of Modern CAPTCHAs (USENIX Security 2023) had 1,400 participants solve 14,000 CAPTCHAs of the types in current deployment, then set the human results beside published results for automated solvers.

Table 3 of the paper, human figures from its own study and bot figures from the prior work it cites. The authors' conclusion: the results "suggest that bots can outperform humans, both in terms of solving time and accuracy, across all these CAPTCHA types."

The same paper notes that bots "often outsource solving to CAPTCHA farms," where people are paid to solve them, and that automated tools passed 99% accuracy on distorted text by 2014. So the gate lets the automation through and charges the public for it. The W3C note, citing Cloudflare's data, puts the charge at "an average of 32 seconds" per CAPTCHA. And some people simply leave: in the USENIX study's abandonment experiment, 174 of 574 participants who started a task containing a CAPTCHA quit before finishing it, a 30% rate. Those were paid participants on Amazon Mechanical Turk, not members of the public with a permit to file, so quote the figure with that context. What the published research does and does not show about conversion is laid out in what CAPTCHAs cost in conversion.

What the law requires, by jurisdiction

None of these instruments names CAPTCHAs. Each incorporates WCAG, so the operative rules are the two WCAG criteria in the first rows, and the jurisdiction rows say which WCAG version applies to whom and from when. Verified against the primary texts in October 2026; this is a summary, not legal advice, and your own obligations depend on your sector and jurisdiction.

What the law does not say

Five claims circulate on vendor pages, including, until we checked, some of ours. None of them survives contact with the primary source, and a compliance reader who has seen them will discount everything near them.

What to run instead has to pass the same tests

The W3C note is as careful about replacements as it is about CAPTCHAs, and its concerns give a public body three questions to put to any vendor, us included.

1. Is it non-interactive? "All else being equal, we prefer non-interactive approaches because these pose no accessibility challenges." If a real person ever has to prove they are human, the accessibility question has not gone away, only moved.
2. What does it collect, and from whom? The note warns that some non-interactive approaches "come at the price of exposing much data about the individual user," and that deployers "are participating in exposing their users to a massive collection of personal data across multiple trans-national data profiling systems." A score-based CAPTCHA from an advertising company is the example it has in mind. For a public body, that data belongs to the public.
3. What happens when it is unsure? Of reCAPTCHA v3, the note observes that "what action is taken in response to an ambiguous score returned by v3 is in the hands of the content provider." In practice that action is a puzzle, served to exactly the visitors least able to complete one: assistive technology, older devices, privacy tools, unusual browsers.

The approaches the note lists as reducing or removing the interactive challenge are spam filtering, proof-of-work, heuristics, honeypots, limited-use accounts and privacy-preserving tokens. An even-handed comparison of the current options, including the free ones and our competitors, is at CAPTCHA alternatives. One trap to know about: a honeypot field hidden only with CSS is still announced to a screen reader, whose user fills it in and is silently rejected. See honeypot vs CAPTCHA for the fix.

Frequently asked questions

Can a government or nonprofit website legally use a CAPTCHA?

In every jurisdiction on this page, yes, on conditions. WCAG Success Criterion 1.1.1 allows a CAPTCHA if its purpose is described in text and an alternative form using a different sense is offered, and WCAG 2.2 adds that a puzzle or transcription test at login needs a non-cognitive alternative. The question for a public body is not whether a CAPTCHA is permitted but whether a test the standards body says excludes many disabled people is a defensible choice when non-interactive options exist and the test no longer stops the bots it was meant to.

Does invisible reCAPTCHA solve the accessibility problem?

It removes the visible challenge for most visitors, which is a real improvement. But it returns a score, and the W3C notes that what happens in response to an ambiguous score is in the hands of the content provider, which in practice means a puzzle for the visitors who score low: assistive technology, older devices, privacy tools. The W3C also warns that non-interactive approaches can come at the price of exposing data about the individual user, and a public body has to weigh that trade on behalf of the public.

Is the SpamKill verification step a CAPTCHA?

No. There is no puzzle, nothing to transcribe or solve, and no timer. Detection runs on how the form was filled in, after the visitor has typed everything. In the minority of cases where we are unsure about a real person, they confirm with a standard social or device sign-in, in any of 13 languages, and continue. If they skip it, the submission is held with everything they typed rather than discarded, and on the Professional plan and up you can review and release it.

What does SpamKill claim about its own accessibility?

Only this: there is no challenge for a visitor to fail. Screen readers and other assistive technology receive the clean version of the form, because the obfuscated version is aimed at automated parsers, not at people. We do not claim a conformance level for your site or for ours, and we would rather you test on your own forms than take our word for it.

We are a nonprofit. Is there a discount?

Yes. Registered charities, 501(c)(3) organizations, schools, libraries and NGOs get 20% off every plan for as long as they are a nonprofit. Tell us your registration or EIN number, we verify it against the public register within one business day, and the discount comes off every invoice from then on.

Sources

The W3C pages were read in full. Study findings come from the published papers and abstracts. Legal rows were checked against the primary instrument or the responsible agency's own page.

Standards

• Inaccessibility of CAPTCHA — W3C Group Draft Note, 16 December 2021.
• Understanding Success Criterion 3.3.8: Accessible Authentication (Minimum) — W3C.
• Web Security and Privacy Technologies — W3C Cognitive Accessibility Task Force, marked out of date by its authors; cited as background.

Law

• Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments — US Department of Justice.
• Guidance on Web Accessibility and the ADA — US Department of Justice.
• Revised 508 Standards — US Access Board.
• Accessibility requirements for public sector websites and apps — UK Government Digital Service.
• Directive (EU) 2016/2102 and Directive (EU) 2019/882 — EUR-Lex.
• EN 301 549 V4.1.1 (2026-09) — ETSI.
• How to make websites accessible — Government of Ontario.

Studies and surveys

• WebAIM, Screen Reader User Survey #10, February 2024.
• Searles, Nakatsuka, Ozturk, Paverd, Tsudik & Enkoji, An Empirical Study & Evaluation of Modern CAPTCHAs — USENIX Security Symposium, 2023 (full text).
• Bursztein, Bethard, Fabry, Mitchell & Jurafsky, How Good Are Humans at Solving CAPTCHAs? A Large Scale Evaluation — IEEE Symposium on Security and Privacy, 2010.
• Gafni & Nagar, CAPTCHA: Impact on User Experience of Users with Learning Disabilities — Interdisciplinary Journal of e-Skills and Lifelong Learning, 2016.