It's a thing. Turn up privacy features in your browser (including the undocumented ones you need to go to about:config to adjust) and stay logged out of google and you'll get them.

Or just fire off a lot of searches pretty fast e.g. by launching a bunch of tabs to search for variations of a term.

If privacy was that important to me, I'd be using DuckDuckGo instead of Google.

In my experience, I find DDG results less relevant.

I settled on Yandex. The only problem sometimes is that results from "internationalized" sites are in Russian.

you're using the wrong browser

If you're accessing via a VPN, not logged into a Google account, doing a bunch of searches quickly... absolutely.

Basically, the more you appear like you might be trying to scrape Google results or otherwise abuse Google with an unreasonable quantity of requests, it'll ask you to prove you're human and not a bot.

I occasionally get them even while logged in. I assume it's some combination of VPN, browser privacy features, and the browser search shortcut (instead of going through google.com or changing the search from another results page).

If Google deems your request suspicious enough, yes.

You can try this yourself by Googling something suspicious, like common Google dorks. After a few variations of WordPress/phpAdmin Google dorks, you'll get a popup asking you to fill out a CAPTCHA to continue.

If you share your IP with lots of people (CGNAT, schools, large offices) then enough weird Googling can get the entire IP address stuck behind CAPTCHA's for a while. It usually clears after a few minutes, but I've seen it last for up to an hour when someone in the network was doing something they shouldn't have been doing.

> like common Google dorks

What is a 'Google dork' and what are the common ones?

Google Dorks are search terms that can find vulnerable services, open directories, that kind of stuff. Stuff you shouldn't put publically on a web server that a search engine manages to find.

This is an example:

>intext:phpMyAdmin SQL Dump filetype:sql intext:INSERT INTO `admin` (`id`, `user`, `password`) VALUES

It'll find publicly accessible phpMyAdmin backups, so don't click any of the results if you want to stay in the legal side of things.

Googling "Google dork" or "Google hacking" should provide you with more examples. If you try modifying the query a few times, Google will make you fill out a captcha.

You can get CAPTCHAs just by turning on a VPN. You don't need to do anything more "suspicious" than that.

I've never experienced this myself. I suppose it depends on what data center the VPN provider is in and what kind of VPN you're using?

Several people mentioned ways you can trigger it using 'nonstandard' (by Google's expectation) methods. In my case I hit it with just regular Chrome whenever I start doing a few searches that use more than basic keywords (so stuff that uses the prefixes like filetype: or parenthesis for logic)

If Google doesn't trust your browser for whatever reason (eg. privacy-conscious browsing).

I get these pretty often on Firefox Focus (Android), not because of any unusual searches (as far as I can tell)! It did at least push me to switch the default search to DDG.

Yes for me it is. I exclusively use a non chromium based browser with some extensions installed and always logged off Google.

on tor browser it shows them always.

If you're not in the US, all the time.

Just searching for documentation on not so well known libraries/errors will often trigger it for me, and I'm talking like 5-10 manual (read: typed by myself into a browser) searches will trigger a Captcha on Google.

Google positions that it suspects suspicious activity from my IP, but hard to guess how they classify this, as it's a stock browser with ublock* that I use every day.

reCaptcha and basically everything Google touches is awful to use outside of the US in my opinion. And I'm still not sure how their full window modal for Google Search Accepting Privacy hasn't been hit by a huge fine by the EU yet, since you absolutely cannot use Google without either blocking the model or going in and agreeing to "something" (you are allowed to turn off several options, but Google will send cookies and instructs you to set your browser to refuse cookies if you don't want them), which I'm positive is really not what GDPR was about at all.

This is part of why I'm against what a lot of US based tech companies do with the Web...they're happy to take money and personal information (forcibly) from non-US persons, but will not give them the same courtesies.

* Of course, maybe that does it...

> If you're not in the US, all the time.

I'm not in the US, never seen it.

It happens to me all the time after I started using VPNs regularly.

tor is great if you don't mind 99% of websites not working on it