I thouht that was most commonly dealth with with a first party cookie. I.e. show the captcha to anyone who doesn't have the cookie. At least that's how it feels when you browse incognito.

What happens if they solve the captcha? If a captcha service costs $0.02 per 1000 captchas that means they can post. That means it costs $10 to post a spam message every minute for an entire year if they get banned after every post. If you want to annoy some site owner that would be an easy way to do so.

Agree - cross site tracking of devices without consent is going the way of the dodos. With respect to fraud prevention, being able to analyse device signatures along with identity and behavior on a per-site basis is the only reason we are enable to enjoy what’s left of the ‘open web’