I noticed that Google's "I am not a robot" reCAPTCHA forces me to check correct images on my computer. I installed a virtual machine and tried there. Same thing. Used proxy. Same thing too. Then I used another computer in the same network (same public IP), but this time the reCAPTCHA doesn't force me to solve it. It just checks itself when I click it. 

Very curious behaviour. I repeated the process a couple times with a few days in between, and some computers never need to solve reCAPTCHA, while others (including brand new virtual machines) behind a proxy need to. I even tried a new browser in a fresh new VM. I'm on a home network, not an enterprise network. I am confused about what triggered reCAPTCHA into thinking it needs to double check me even when using new virtual machine behind a proxy?

On computers where it isn't suspicious, I can delete all the cookies, history and caches, visit a website and reCAPTCHA just lets me go without any concerns. So it can't be solely based on my past activity. On the other hand, if I indeed solve the reCAPTCHA and register for an account on a website, the website is missing all the functionality for registered users.



Also, when I'm presented with a CAPTCHA, even on brand new VMs, the functionality of registered users is limited. Which leads to thinking that reCAPTCHA sends information of what it thinks about a specific user to the website owner. Is this a documented behaviour? 

Google tries to figure out if you are a bot or not. If it's in doubt, it serves you a CAPTCHA to check. Exactly how this is done is part of Google's secret sauce, and I don't think they will tell you. But here are some ingredients I guess that they mix together:


Your IP: Has it been identified as a bot already? Is it a Tor exit node?
The resources you load: A simple bot does not load styles or images, since it does not need them. That is a tell tale sign that someone is not human (or, as JDługosz points out in comments, blind).
Sign in: Are you signed in to a Google account? Does that account appear to belong to a real person?
Your behaviour: A human scrolls down the page, moves the mouse around, takes some time between pushing down the mouse button and releasing it. A human does not click the dead center of the check box every time. All this could be mimmicked by a good bot, but it is not easy. 
Your history: Google knows a lot of your browsing history. Bots usually don't have a browsing history.


Figuring out exactly why you need to solve the CAPTCHA sometimes, but not others, is not easy. I could imagine that a fresh virtual machine has a browser fingerprint - installed fonts, plugins, etc - that is very common and therefore fishy enough for Google to flag your for a CAPTCHA. If you are behind a proxy, perhaps others have used it as well for non legit activities.

That you don't get a CAPTCHA when you clean your cookies is surprising. I don't understand why - then Google knows very little about you and should assume you need a CAPTCHA to be on the safe side. Perhaps they do some advanced browser fingerprinting so they still know who you are?

Do note that all of this is speculation. If you want more speculation, have a look at How does new Google reCAPTCHA work?.
