Not entirely accurate. The GDPR restricts the terms they can use, for example. And anti-discrimination law probably also applies. These don't really apply to captcha, of course, under current interpretations.
My reCaptcha strategy is to fire off an email to the site owners every time I am subjected to a reCaptcha, asking for all my data under GDPR. Most websites only need a few such requests to quickly start looking for an alternative. Fuck Google and their constant attacks on my rights.
