With the continuous increase in automated Internet traffic, bot detection systems become vital to safeguard users and website integrity, necessitating methods to differentiate between human and bot-generated traffic. CAPTCHA systems, such as Google’s reCAPTCHA, serve as a primary defence by presenting tasks that only humans can solve. Nonetheless, these systems have generated privacy concerns due to their extensive data collection practices, especially considering Google’s business model, heavily oriented towards advertising. This paper evaluates Cloudflare’s Turnstile, a privacy-focused CAPTCHA alternative, and their claims of compliance with the European GDPR and ePrivacy Directive. A comparative analysis of reCAPTCHA and Turnstile was conducted by deploying both systems on test websites, analysing network traffic, HTTP requests, and script behaviour to assess data transfer and privacy implications. The study also reviewed relevant privacy regulations and de-obfuscated Turnstile’s client-side code to examine its security mechanisms and data collection practices. Findings reveal that both systems operate similarly by issuing tokens post-verification for back-end validation, with Turnstile aligning with GDPR through its avoidance of tracking cookies. However, a vulnerability previously identified in reCAPTCHA was replicated in Turnstile, demonstrating its susceptibility to token exploitation. While reCAPTCHA, in its current form, faces challenges in conforming to GDPR requirements, Turnstile demonstrates potential as a privacy-conscious alternative offering comparable security features. Nonetheless, future regulations may challenge its compliance, highlighting the need for continuous adaptation to evolving privacy standards.