It's privacy focused (supports privacy pass), and is fair: webmasters get a cut for each captcha that is solved correctly (they can choose to directly donate it to a charity of their choice), hCaptcha get a cut for running the service and a customer will get their images/data labeled.
In a lot of projects lately where I've seen ReCaptcha used or requested I've replaced it with YAGNI [You Aren't Going to Need It]. It's a "what's your threat model?" question for Bots.
Do you have the scale that human moderators are infeasible? (Not do you "wish to have". YAGNI suggests add it when you have that scale, not before.)
Do you need that form to be publicly accessible?
Are you requiring multi-factor authentication already? Can you or should you?
Can you use a spam filter? (Are you sure your process isn't already going through half a dozen email spam filters anyway?)
Do the simple tricks not work for your use case? (CSRF tokens, "honeypot fields", form name/ID obfuscation, dumb simple weird rotating required fields like "2 + 2 =?")
I recently had to add a 10 second period where the contact form send button is disabled but appears to still work.
There was daily contact form spam coming from tor exit nodes. Only flaw is that it always sends the message within 7 seconds. That is faster than a human could get to the form and type a meaningful message.
So I was able to avoid blocking tor exit nodes by adding this timeout. This has solved the issue, for now.
Requiring JS execution by only accepting JSON stopped the lazier bots.
