Like any US-based service (or one controlled by a US company), reCAPTCHA is subject to US laws which mean they CANNOT guarantee that your PII is only used for fraud detection purposes because the govermnet can order them at any time to hand over that data while also ordering them to keep silent about that.