As reported by Boing Boing, a 2023 study out of UC Irvine, "Dazed and Confused: A Large-Scale Real-World User Study of reCAPTCHAv2" concluded that not only are CAPTCHAs ineffective at actually preventing bot traffic, they introduce privacy concerns through tracking cookies, have wasted billions of hours of our collective time, and generated nearly a trillion dollars worth of data for Google, which acquired the ubiquitous reCAPTCHA utility back in 2009.
The study focuses on the two most common forms of CAPTCHAs you'll find out in the wild through Google's reCAPTCHAv2: «Invisible» or behavior-based CAPTCHAs which analyze your inputs as you check that «not a robot» box or even surreptitiously as you browse a website, and image-based CAPTCHAs, where you select all the motorcycles, traffic lights, or what have you in images sourced from Google Street View.
Both are valuable to Google, with the tracking cookies generated by the former potentially contributing to ad targeting, and data from the latter being applied toward AI model training, either internally at Google or sold to another company.
This experiment did not inform its subjects, and instead added Google's reCAPTCHAv2 to the account creation and password recovery functions of an internal student account system at the university, with the researchers both measuring time to complete the CAPTCHAs and surveying a subset of the 13-month study's 3,600 users about their experience.
Predictably, they took more time and surveyed negatively when it came to the more involved image detection CAPTCHAs. The study also noted variations in completion time across education disciplines, experience level, and for whether they were creating or recovering an account.