With the question type „Captcha“, SoSci Survey allows you to include services that prevent, or at least impede, a program (bot) from filling out the questionnaire automatically. Different solutions are available:
Using a bot to automatically fill out questionnaires involves additional effort (as of 2026). In scientific surveys, it is therefore unlikely that such attacks on the data collection occur frequently. However, prize draws or other incentives, for example, may be a motivation. Also, if respondents are recruited via service providers and are paid for completing the questionnaire, participants could be motivated to use bots.
Classic captchas (e.g., recognizing distorted letters or the arithmetic problem integrated in SoSci Survey) hardly pose a challenge for AI models anymore. Moreover, it is conceivable that paid participants solve captchas manually in the course of a questionnaire.
Therefore, a captcha generally does not provide reliable protection against automated completion. However, there is no guarantee either that humans fill out a questionnaire sensibly and truthfully. In some cases, data quality issues can be identified by means of meta data, but there is no guarantee for that either. The risk of false data generally is part of the survey method, and for online surveys the risk is higher than for printed questionnaires.
If you select the arithmetic problem in the captcha element, SoSci Survey displays such a problem in place of the element, and the respondents can only continue if they have entered the correct solution.
This measure impedes mass completion by submitting prepared server requests, but it can be circumvented with moderate additional effort.
With reCaptcha, files are loaded from servers outside the EU (typically USA), and the IP address of the respondent is transmitted to the provider (Google) in the process. The service is offered free of charge, and it has to be assumed that the provider can collect and exploit information about the visitors of a website through the service.
In 2026, the service was reorganized with regard to data protection. You as the project manager or your institution are the controller of the data processing within the meaning of the GDPR. reCaptcha is a subcontractor. To avoid multi-level commissioned data processing, you must register reCaptcha yourself via a Google account and (!) take care of the data protection tasks for using reCaptcha (e.g., documentation, concluding a data processing agreement via the reCaptcha website).
The provider Friendly Captcha is generally regarded as a privacy-friendly solution. However, as the user data is not exploited or sold, using the service incurs costs.
To use Friendly Captcha, first register a user account at Friendly Captcha (30 days free trial, subject to a charge thereafter).
Note: Currently (as of 2026), Friendly Captcha guarantees the restriction of data processing to servers within the EU only in the Advanced plan, which costs many times as much as the Starter plan. Please clarify possible implications with your data protection officer.
If you would like to use another provider, you can include the necessary HTML code in the questionnaire as a text (display mode: HTML code). This HTML code usually contains a public API key of the provider.
By means of readGET(), you can read form elements created by the captcha, and by means of sendJSON() you can check whether the response was correct. A secret API key of the provider is required for this check.
Note: Including external scripts in the questionnaire may result in data protection challenges (for example, commissioned data processing according to the GDPR). Ask your data protection officer for details.