Your CAPTCHA is a barrier. Since June 2025, also a legal risk.
Germany's Accessibility Strengthening Act, the national implementation of the European Accessibility Act, is in force. If you sell online to consumers, your service has to be accessible. And the spot where you fight off bots is exactly where people with disabilities get stuck most often.
- In force since
- 28 Jun 2025
- Barrierefreiheitsstärkungsgesetz (BFSG) - Germany's implementation of EU Directive 2019/882.
- Fines up to
- €100,000
- On top of that, the authority can order fixes and, in the worst case, prohibit you from offering the service.
- Enforcement
- underway
- The German states' joint market surveillance authority has been based in Magdeburg since autumn 2025. Since early 2026 it has been in its active enforcement phase, acting on complaints and on its own initiative.
What the BFSG asks of your website.
The BFSG requires providers of e-commerce services to make their offering accessible: findable, reachable, usable. With a screen reader. With a keyboard alone. At 200% zoom. It covers anything a consumer can enter a contract through - your shop, your booking form, your login, your checkout.
The yardstick is the harmonised standard EN 301 549, which refers to WCAG level AA for web content. You also have to describe how you meet the requirements: accessibility information belongs on the site, not in a drawer.
Six cases, one clear yes or no.
The situations customers send us most often - in the order they ask about them.
| Your case | BFSG | Why |
|---|---|---|
| Consumer online shop | Yes | The standard case: contracts concluded through an e-commerce service. |
| App with ordering or booking | Yes | The interface is part of the service - web or app store, same answer. |
| Banking, ticketing, passenger transport | Yes | The law names these sectors explicitly. |
| B2B only | No | The BFSG protects consumers. No B2C offering, no obligation - until you have one. |
| Micro-enterprise, services | No | Fewer than 10 employees and no more than €2m annual turnover or balance sheet total. Both have to be true, and both can change. |
| Micro-enterprise placing products on the market | For the products | The exemption only covers services. Terminals, routers, e-readers and the like stay in scope. |
Five people who fail your image puzzle.
The CAPTCHA sits at the most expensive spot on your site: right before submit. Anyone who gets stuck there doesn't buy - and may well complain to someone with authority.
Further reading: W3C: Inaccessibility of CAPTCHA (2021) · WCAG 2.1, success criterion 1.1.1
With CAPTCHA less interactivity is clearly more accessibility.
The W3C working group explicitly recommends approaches that need no interaction at all: heuristics, behavioural analysis, tokens. That's exactly what happens on our side, before your API answers. Your users never see any of it.
Make the CAPTCHA accessible. Or get rid of it.
Both are allowed. One is a job that never ends, the other is a decision.
| Task | Keep the CAPTCHA | No CAPTCHA |
|---|---|---|
| Text alternative & second sensory channel | Maintain an audio fallback and a text alternative | Nothing to describe - there is no element |
| Keyboard operation | Focus order, focus trapped in the dialog, escape route | No dialog, no focus trap |
| Time limits | Let users extend or turn them off | No task, no clock |
| 200% zoom | The grid has to scale without falling apart | Nothing to scale |
| Every form | Login, checkout, contact, newsletter - tested one by one | One script tag for the site, one verify call per route |
| After every update | Retest - the vendor changes the widget whenever it likes | Nothing changes in the frontend, because nothing is there |
We take one barrier off your plate. Not the work.
The barrier goes, the protection stays
Vinishu reads the TLS handshake, headers, request shape, and behaviour, then decides in 8–10 ms, before your application answers. Nothing shows up on your page: no widget, no dialog, no timer, nothing a screen reader has to announce or a keyboard has to reach.
What stays your job
Contrast, focus states, form labels, error messages, heading structure, operation without a mouse. We don't touch your frontend. Anyone telling you that bot protection makes your shop BFSG-compliant is selling you something.
One line for your accessibility statement
"No interactive test is used to defend against automated access. Verification happens server-side, without any user interaction." That's one exception fewer to justify - and a line that's true.
Does Vinishu make my shop BFSG-compliant?
No. Vinishu removes a single, very visible barrier. Contrast, keyboard operation, structure, and forms stay your job. Anyone promising compliance by installation hasn't read the law.
Isn't an invisible CAPTCHA like reCAPTCHA v3 enough?
Invisible doesn't mean absent. When confidence drops, the challenge shows up anyway, right as the user hits submit. For whoever is facing it, that's an ordinary image puzzle. And for you it's still an element you have to test and document.
Isn't the "I'm not a robot" checkbox accessible?
The checkbox itself is operable. The problem is what comes next: at the slightest doubt, the tile grid opens with a time limit. Accessibility is measured on the worst path, not the best one.
We're a micro-enterprise - does this even apply to us?
For services the exemption applies if you have fewer than 10 employees and no more than €2m in annual turnover or balance sheet total. Both have to be true. If you're just under the line, keep it in your calendar, not in your gut.
Who enforces this, and what happens on a violation?
The joint market surveillance authority for accessibility in Magdeburg. It acts on complaints and on its own initiative, and some of its checks are automated. It can order fixes, set deadlines, and in the worst case prohibit the service. It can also issue fines of up to €100,000.
Will switching cost me conversions?
The other way around. The CAPTCHA sits right before submit, and every second there costs completions. Take it out and the friction disappears for everyone - not just for people with disabilities.
How long does the switch take?
SDK: one script tag and one verify call. Then Vinishu runs alongside in shadow mode for two weeks and only scores. That way you see what happens on your real traffic before you turn the CAPTCHA off. The reverse proxy - one DNS change - comes later.
What about data protection? That was an issue with reCAPTCHA too.
A second problem with the same root. A CAPTCHA from a US vendor loads third-party resources and processes user data before anyone has consented. Vinishu ships a script tag too - but it loads nothing from third parties, builds no profile of your users, and sends its signals to an endpoint in the EU. We see request metadata, not content. Details are on our trust page.
Find out how exposed you are to bot attacks
Give us the link to your website. We check your public pages and show you every weak spot where we can't see any bot protection. Nothing gets submitted.
- Free
- Passive
- 90 seconds
Swap your CAPTCHAs for invisible protection.
Add the script tag and an HTTP request in your API, and bot protection is on. Our team helps you set it up. Then you test Vinishu in a two-week pilot, with a traffic analysis at the end.