A giveaway entry form went live, someone on the team was told to “add a CAPTCHA” so the contest would not fill with junk, and a few days later a quota or billing message appears in the Google Cloud console. Nobody remembers choosing a meter. This is a short account of what that meter counts, what Google and Cloudflare publish about their free allowances, and what the pages leave unstated.
The notice that arrives after the giveaway goes live
Picture a campaign entry form linked from a social post. The form tool was chosen first. The bot check was bolted on late, because entries started to look machine-made. The notice shows up in a console the marketing team rarely opens, and it concerns a different counter from the one the form tool already keeps.
That is the point worth fixing first. The bot check has its own meter, separate from the response meter on the form tool itself. The response side is covered in the post on response-metered form tools. This post covers only the bot check.
The unit matters before any price does. Google’s billing page counts assessments. It does not count visitors, page views or form submissions. Everything below follows from that one word.
What Google’s billing page actually says
Google’s billing page now describes the product as part of Google Cloud Fraud Defense, with reCAPTCHA named as a part of it. Readers will still search for reCAPTCHA, so both names appear here. The figures below were read from the billing page and the compare-tiers page on 2026-10-08. Both pages carry the stamp “Last updated 2026-10-06 UTC”.
| Tier | When it applies | Cost as published |
|---|---|---|
| Essentials | Applied automatically to new keys in projects without billing enabled | Free, up to 10,000 assessments per calendar month per organization |
| Premium | Applied when billing is enabled on the project | 0 to 10,000 assessments a month free; 10,001 to 100,000 a $8 flat fee; over 100,000 at $0.001 per assessment ($1.00 per 1,000) |
| Enterprise | High-volume users who contact Sales | Subscription with volume discounts. No price is published on the pages read. |
The free allowance is per organization per calendar month. Google states that it aggregates across all accounts and all sites, and that it includes assessment traffic across all keys, web pages and mobile applications, whichever tier the projects use. A second site, an abandoned project or a mobile app under the same organization draws on the same 10,000.
Where the cap lands depends on whether billing is on
The billing page gives two different behaviours at 10,000.
Essentials, no billing account attached. Any further CreateAssessment request returns a Resource Exhausted (429) quota error until the quota resets on the first day of the next calendar month. In plain words, the server-side call that asks Google “is this entry a bot?” stops getting an answer. What the form then does with the entry is the form builder’s decision. It might accept the entry unchecked, reject it, or hold it. Google’s page does not say, and neither does this post. That behaviour lives in your form’s code or your form tool’s settings.
Premium, billing account attached. Requests remain active without interruption and are billed at the published tiers.
Google gives worked examples. Quoted as Google’s own, not as a calculation about any real campaign:
Example 3 describes a Premium project with billing enabled that processes 25,000 assessments in a calendar month. The first 10,000 are free under the monthly allowance, and the remaining 15,000 are billed on the Cloud Billing invoice under Premium tier rates.
Example 1 is the one that catches teams out. Two projects without billing, Project A and Project B, share a single 10,000 limit. If A processes 7,000 assessments and B processes 3,000 in the same month, cumulative usage reaches the limit. An older project quietly running on another site can therefore use up the allowance before a campaign starts. Example 2 follows from it: if those projects pass 10,000 while billing stays off, requests after the 10,000th return the quota error, and enabling billing moves them to Premium.
Which unit a giveaway generates
Three things get conflated: visitors to the page, form submissions, and assessments. They are different counts. Google’s page defines the meter as assessments created through the API. It publishes no ratio between visitors, submissions and assessments, and this post does not invent one. Measure your own.
What follows is reasoning, not data. If the meter counts calls to the assessment API, then any scripted or repeated submission that triggers a call is metered the same as a human entry. A giveaway is an attractive target for repeat submissions because the prize is the incentive. As a purely hypothetical illustration with round numbers: if a form made 10,000 assessment calls in a single day, that would be the whole month’s free allowance, whether the calls came from 10,000 people or from one script. Nothing here says any real form behaves that way.
One more caution from the compare-tiers page. A footnote there says some features “require an extra assessment”. Check the feature rows you plan to use before assuming that one entry equals one assessment.
The same shape appears elsewhere on a campaign landing page. A spike empties a free quota, as covered in the piece on free session recorders and the spike that empties the quota, and the question of what happens at the cap recurs in what happens at the cap for QR scan limits.
How Cloudflare Turnstile’s plan page frames it
Cloudflare’s Turnstile plans page, fetched 2026-10-08 and showing “Last updated Aug 14, 2026”, meters different things. It lists the following.
| Item | Free | Enterprise |
|---|---|---|
| Widgets | Up to 20 per account | Unlimited |
| Challenges (traffic or verification requests) | Unlimited | Unlimited |
| Hostnames per widget | 10 | Maximum of 200 |
| Any-hostname widget | No | Yes |
The difference is in what each page publishes. Google’s page meters assessments, the checks themselves. Cloudflare’s page limits widgets and hostnames and lists challenges as unlimited. That is a description of two pages, not a verdict, and this post does not rank them. No Cloudflare price is stated here because the plans page gives only “Free” and “Contact Sales”.
Cloudflare also publishes a migration-from-reCAPTCHA guide at developers.cloudflare.com/turnstile/migration/recaptcha/. It says migration involves replacing the siteverify URL on the server and updating the front-end widget. It says nothing about effort that this post will repeat.
What neither page states is how the vendor decides that a given submission is a bot, or how often it is wrong in either direction.
Checks to run before the form goes live
- Check which tier each key sits on. No billing account attached means Essentials and a 429 at the cap. Billing attached means Premium and overage billing.
- Find the organization’s other projects and keys. The allowance is shared across all of them, including web pages and mobile apps.
- Know where to look. The billing page names billing reports and the Fraud Defense usage dashboard, which shows billed assessments over the last 30 days, and says Cloud Logging and quota metrics can show RESOURCE_EXHAUSTED status codes.
- Decide in advance what the form does when the check errors. Whether an entry is accepted or dropped is the form builder’s call, not the vendor’s.
The billing page also says email notifications are sent when usage approaches the allowance and when it is exceeded, so confirm that someone reads the inbox those go to.
Verification and scope note
Prices verified 2026-10-08 from the vendor pages linked above. This is not Watchdog data and is not on the re-verification schedule, so the figures may change without this page being updated.
followedapp is published by the team behind RecurPost, which is covered as vendor #34 under the same rules as every other vendor.
Next step
Before the next campaign, open the Google Cloud console, list every project in the organization, and write down which tier each key is on and what the form does when the check fails.
FAQ
What happens at 10,000 if billing is not enabled?
Per the billing page, CreateAssessment requests return a Resource Exhausted (429) quota error until the quota resets on the first day of the next calendar month. How the form reacts to that error is up to the form.
Is a visitor, a form submission and an assessment the same thing?
No. Google meters assessments, and its page publishes no ratio between visitors or submissions and assessments, so measure your own.
Sources
- Google Cloud, Fraud Defense billing information, fetched 2026-10-08
- Google Cloud, compare tiers, fetched 2026-10-08
- Cloudflare Turnstile, Plans, fetched 2026-10-08
- Cloudflare Turnstile, migrate from reCAPTCHA, fetched 2026-10-08