reCAPTCHA needs to be re-engineered to work even in the face of privacy measures in browsers. Otherwise it will be better at distinguishing expert humans from ordinary humans than at distinguishing bots from humans.
I'm sure there's room for improvement but at some point this is paradoxical. Users who want data privacy want their presence and behavior obfuscated, which is fundamentally opposed to anti-fraud systems which are designed to analyze the presence and behavior of users to determine if they are fraudulent.
The way recaptcha happens to work now, and its purported goal - to differentiate humans from bots - are two different things. Privacy is not fundamentally opposed to anti-fraud in the slightest.
I said that privacy is fundamentally opposed to anti-fraud systems, not the general concept of anti-fraud. To an automated anti-fraud system, there is no difference between a user who obfuscates their identity because they want privacy and a bot who obfuscates its identity because it doesn't want to be revealed as a bot.
