GDPR
Last updated 23 August 2026
What a UK or EU controller needs to know before putting BlockAgents.ai on a form — including why it does not need a cookie banner.
This page is practical guidance, not legal advice. Your DPO or counsel owns the final call.
Do I need consent to use it?
On our analysis, no — and the reason is that there is nothing to consent to.
Consent under the ePrivacy Directive (in the UK, PECR regulation 6) is required for storing or accessing information on a user’s device. The widget stores nothing: no cookie, no localStorage, no sessionStorage, no IndexedDB, no cache-based identifier. It reads nothing from the device either — no fingerprinting of canvas, fonts, audio, or hardware. PECR regulation 6 is therefore not engaged, so the widget does not belong in a consent banner and does not need a “non-essential” toggle.
Separately, under Article 6 GDPR, processing needed to protect a form from automated abuse rests comfortably on legitimate interests — Recital 49 names network and information security explicitly. In our case the balancing test is close to trivial, because the processing consists of an IP address used transiently and never retained.
This is the substantive difference from reCAPTCHA
reCAPTCHA has repeatedly drawn regulatory attention in the EU because it sets cookies, collects device and behavioral signals, and transfers data to Google. Controllers using it generally need it behind a consent banner and need to account for the transfer. None of those questions arise here, because none of that data is collected or sent anywhere.
Am I the controller?
Yes, for your own site. You decide to place a challenge on your form, so you determine the purpose. We act as your processor for challenge traffic under the DPA, which is incorporated automatically when you accept the terms — no signature required, though we will countersign on request.
What do I put in my privacy notice?
Something like this, adapted to your wording:
We use BlockAgents.ai to protect our forms from automated abuse. It shows a short visual challenge. It sets no cookies, stores nothing on your device, and does not track you across sites. Your IP address is used momentarily to rate-limit requests and is not retained. See https://blockagents.ai/privacyWhat goes in my Article 30 record?
| Purpose | Protecting web forms from automated abuse |
| Lawful basis | Article 6(1)(f), legitimate interests — network and information security (Recital 49) |
| Categories of data | IP address, transient, used for rate limiting and not retained |
| Data subjects | Visitors to your site |
| Recipients | [Legal entity name] as processor; see our subprocessor list |
| Transfers | [Confirm against the chosen hosting region] |
| Retention | Challenge records under 2 minutes; tokens under 5; no visitor data retained |
Do I need a DPIA?
Adding BlockAgents.ai is unlikely on its own to trigger the Article 35 threshold: there is no systematic monitoring, no profiling, no special category data, and no evaluation of individuals. If the wider processing you are doing needs a DPIA, we will help you complete the parts that concern us — email privacy@blockagents.ai.
International transfers
[Primary hosting region]. Where personal data leaves the UK or EEA we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated by section 9 of the DPA.
Data subject requests
If one of your users asks you what BlockAgents holds about them, the answer is nothing. We store no identifier for a person who solved a challenge, so there is no record to retrieve, rectify, or erase — and no lookup key we could use even if we wanted to comply. Forward anything you would like us to confirm in writing to privacy@blockagents.ai.
Accessibility and the EAA
Worth flagging in the same breath as compliance, because it points the other way. The challenge is visual and depends on motion, and we do not currently offer a non-visual alternative. If you are subject to the European Accessibility Act or an equivalent obligation, read this before deploying, and keep an alternative route to your form open.