I always assumed it used your IP, tracking history etc. to decide. Am I wrong about that?

I'm sure it takes that into account, plus whether you are logged into any google account with associated meta information about you at the time.

It also learns about typical usage on that page, it trains about usage patterns, mouse movements etc.

We find it very effective in eliminating bot spam.

It's also very effective at excluding people like me. Even when logged in to a Google account with a very benign history (mostly used to watch youtube) with years (>4) of regular activity, Google won't[1] even attempt reCAPTCHA (any version) because they think my browser isn't one of the handful of specific browser versions they support[2]. The actual browser version is fine, it's configured similar to the Tor browser minimize data leaks and browser fingerprinting. So I cannot use any site with reCAPTCHA not because of any technical limitation; unless I "upgrade"[1] to a configuration that leaks a lot more data.

[1] https://imgur.com/9wT9yZ2 [ignore font/layout issues in that image - my usercss and fontconfig/freetype font rendering settings are very unusual, complex, and often very disruptive]

[2] https://support.google.com/recaptcha/?hl=en#6223828 "We support the two most recent major versions of the following: [Desktop: Chrome, Firefox, Safari, Edge]"

> We consider that the agent successfully defeated the reCAPTCHA if it obtained a score of 0.9