As reported by Boing Boing, a 2023 study out of UC Irvine, "Dazed and Confused: A Large-Scale Real-World User Study of reCAPTCHAv2" concluded that not only are CAPTCHAs ineffective at actually preventing bot traffic, they introduce privacy concerns through tracking cookies, have wasted millions of hours of our collective time, and generated nearly a trillion dollars worth of data for Google, which acquired the ubiquitous reCAPTCHA utility back in 2009.
The study focuses on the two most common forms of CAPTCHAs you'll find out in the wild through Google's reCAPTCHAv2: "Invisible" or behavior-based CAPTCHAs which analyze your inputs as you check that "not a robot" box or even surreptitiously as you browse a website, and image-based CAPTCHAs, where you select all the motorcycles, traffic lights, or what have you in images sourced from Google Street View. Both are valuable to Google, with the tracking cookies generated by the former potentially contributing to ad targeting, and data from the latter being applied toward AI model training, either internally at Google or sold to another company.
This experiment did not inform its subjects, and instead added Google's reCAPTCHAv2 to the account creation and password recovery functions of an internal student account system at the university, with the researchers both measuring time to complete the CAPTCHAs and surveying a subset of the 13-month study's 3,600 users about their experience. Predictably, they took more time and surveyed negatively when it came to the more involved image detection CAPTCHAs. The study also noted variations in completion time across education disciplines, experience level, and for whether they were creating or recovering an account.
The researchers took the average completion time of 3.53 seconds across both image and behavior CAPTCHAs and multiplied that against a low-end estimate of 512 billion v1 and v2 reCAPTCHAs completed across the internet between 2010 and 2023, resulting in the following estimations of their impact on our lives:
- 819 million hours spent solving CAPTCHAs.
- $6.1 billion worth of our time at the US federal minimum wage.
- 134 Petabytes of internet bandwidth.
- consuming 7.5 million kWhs of energy.
- which produced 7.5 million pounds of CO2 pollution.
- This one's from me: putting the 819 million hours against the average human lifespan of 79 years, that's 1,182.7 lifetimes spent solving CAPTCHAs.
Comparing the new study's time and accuracy rates to bots, while also looking at previous studies on the increasing capability of automated processes to solve CAPTCHAs, the researchers concluded that bots are now faster than humans at completing reCAPTCHAv2's checkboxes, while they take more time, but are more accurate when it comes to image detection. The researchers also argued that the tracking cookies in fact introduce a new security and privacy risk. Looking at Google's stated value for collections of labeled image detection data and the lifetime value of an individual tracking cookie multiplied by the estimated lifetime amount of reCAPTCHAv2s completed, the researchers came up with the following values for Google:
- $8.75-$32.3 billion for its full reCAPTCHAv2 dataset, which could theoretically be sold multiple times to different vendors.
- A lifetime value of $888 billion for all of reCAPTCHAv2's tracking cookies produced between 2010 and 2023.
"It can be concluded that the true purpose of reCAPTCHAv2 is as a tracking cookie farm for profit masquerading as a security service," the researchers stated in the final portion of the study, arguing that reCAPTCHA should be deprecated for its lack of genuine contribution to the internet's safety or functionality. Two years on from this study, there's no sign of that happening any time soon.
