Home

/

Glossary

/

Browser

/

DataDome

Browser

6 min read

Also: DataDome bot protection, DataDome CAPTCHA, DataDome slider, captcha-delivery.com, datadome cookie, x-datadome, DataDome Device Check

DataDome

Quick answer

DataDome is a commercial bot-protection service that scores every request to a website, app or API in real time and blocks or challenges automated traffic with an invisible Device Check or a slider CAPTCHA from captcha-delivery.com. A 403 that carries a datadome cookie or an x-datadome header means DataDome blocked you; see 403 Forbidden for what to try.

DataDome is a commercial bot-protection service that scores every request to a website, app or API in real time and blocks or challenges automated traffic, using an invisible Device Check and a slider CAPTCHA served from captcha-delivery.com.

Anti-bot system
Official site ↗

Last verified

What people do with DataDome

Key facts

Made byDataDome (founded in Paris, 2015)
HeadquartersNew York, Paris and Singapore
ProductsBot Protect, Account Protect, DDoS Protect, Ad Protect, API protection
ChallengesDevice Check (invisible) and a slider CAPTCHA, served from captcha-delivery.com
DeploymentServer-side module on the CDN or web server plus a JavaScript tag or mobile SDK
Pricing modelCommercial subscription, sold through sales

What is DataDome?

DataDome is a commercial bot-protection and online-fraud-prevention service. The company was founded in Paris in 2015 and now lists headquarters in New York, Paris and Singapore. Its main product, sold as Bot Protect (alongside Account Protect, DDoS Protect, Ad Protect and API protection), sits in front of a website, mobile app or API and decides in real time, request by request, whether the traffic comes from a person or from automation.

DataDome is particularly common on e-commerce, ticketing, travel and classifieds sites, the kinds of sites that suffer from scalping, price scraping, credential stuffing and fake account creation. Forrester named it a Leader in its 2024 Bot Management Software Wave. If you have ever loaded a retail or classifieds page and been shown a slider puzzle on a plain page instead of the product, there is a good chance it was DataDome.

Unlike a CAPTCHA widget that a site embeds in one form, DataDome protects every request. That is why people searching for it are usually not filling in a form; they are trying to load ordinary pages and getting blocked.

How DataDome works

DataDome is deployed as a server-side integration (a module for the CDN, load balancer or web server, such as Cloudflare, Fastly, Akamai, NGINX or AWS) plus a JavaScript tag or mobile SDK on the client. For each request:

  • The edge module sends request metadata to DataDome's detection API. That includes the IP address, headers, the user agent, TLS and HTTP characteristics, and the datadome cookie if the visitor already has one.
  • DataDome scores the request using signals it has collected from the client-side tag (browser and device fingerprinting, behavior such as mouse and touch events) and from traffic patterns seen across its customer base.
  • The module enforces the decision. Legitimate traffic passes through untouched. Suspicious traffic receives a challenge. Clearly automated traffic is blocked, usually with an HTTP 403.

    • The challenges are served from DataDome's own domain, typically captcha-delivery.com (for example geo.captcha-delivery.com). DataDome currently offers:

  • Device Check: an invisible verification that runs in the visitor's browser with no interaction.
  • Slider CAPTCHA: a lightweight slider puzzle shown when more verification is needed. DataDome says the vast majority of real users never see it; that is a vendor claim.

    • Passing a challenge refreshes the datadome cookie, which marks the session as verified for a while. A blocked response often carries that cookie and an x-datadome response header, which is the easiest way to recognize DataDome when you are debugging.

    Why DataDome appears in automation

    DataDome's customers buy it specifically to stop scraping and automated account abuse, so automated sessions are exactly what it is looking for. Typical symptoms:

  • HTTP 403 on every request from a script. A plain HTTP client (Python requests, curl, a no-code HTTP step, Google Sheets IMPORTXML) sends almost none of the browser signals DataDome expects, and never runs its JavaScript.
  • The first page loads, then you are blocked. Request rate, navigation pattern and missing cookie refreshes all feed the score. See rate limiting.
  • A slider puzzle in a real browser. Automated browsers built with Selenium WebDriver, Puppeteer or headless Chrome expose traits that the client-side checks pick up, and datacenter IP addresses carry low reputation.
  • Works locally, fails from the cloud. The same script behaves differently from a home connection and a server, because IP reputation is part of the score.

    • What to do instead of fighting it

    When a site has paid for DataDome, it has made a clear decision about automated access. The approaches that hold up are:

  • Use the official API, feed or affiliate program. Many retailers and marketplaces offer product feeds or partner APIs precisely so that partners do not have to scrape.
  • Ask for access. Site owners can allow-list known partners in DataDome.
  • Collect less, less often. A monitor that checks a few pages a day as a signed-in customer is a very different thing from crawling a catalog.
  • Keep a person in the loop for the occasional challenge on accounts you own.

    • Read the site's terms and robots.txt, and see our guide on whether web scraping is legal. This page does not cover techniques for evading DataDome; vendors selling "DataDome bypass" are selling a way around a site's explicit wishes.

    DataDome and Autonoly

    Autonoly's agent works in a real, headed Chromium browser, so pages load and run JavaScript as they would for a person. That does not make it invisible to DataDome, and Autonoly does not claim it is: it does not solve DataDome challenges, and it does not use proxies or rotate IP addresses. If a DataDome slider or block page appears, the agent stops and hands you the browser through live browser control. If the site keeps blocking, the honest answer is an official data source rather than more retries.

    Why It Matters

    DataDome protects many of the retail, travel, ticketing and classifieds sites people most want to monitor or scrape. Recognizing it (403s, a datadome cookie, a slider from captcha-delivery.com) tells you quickly that the problem is a deliberate block, not a broken selector, and that an official feed or permission is the realistic path.

    How Autonoly Solves It

    Autonoly does not solve or bypass DataDome and has no proxies. Its agent uses a real headed Chromium browser, and when a DataDome slider or block page appears it stops and hands you the live browser so you can decide what to do.

    Learn more

    Examples

    • A price-monitoring script built on Python requests receives HTTP 403 with a datadome cookie on every product page, because it never runs DataDome's JavaScript

    • An agent browsing a classifieds site is shown a slider from geo.captcha-delivery.com after a few pages; it pauses and hands control to the user

    • A reseller replaces its scraper with the retailer's affiliate product feed after repeated DataDome blocks

    Frequently Asked Questions

    DataDome is a commercial bot-protection service founded in Paris in 2015. It sits in front of websites, apps and APIs, scores every request in real time and blocks or challenges traffic it judges to be automated, such as scrapers, scalpers and credential-stuffing bots.

    Common signs are an HTTP 403 response that sets a cookie named datadome, an x-datadome response header, and a challenge page or slider loaded from captcha-delivery.com, often geo.captcha-delivery.com.

    It is DataDome's visible CAPTCHA, a slider puzzle shown when a session needs more verification than the invisible Device Check provides. DataDome says most legitimate users never see it.

    VPNs, privacy extensions, unusual browsers, shared or datacenter IP addresses and very fast navigation can all lower a session's score. Disabling the VPN or extension and completing the slider usually restores access. If not, contact the site with the reference shown on the block page.

    It depends on jurisdiction, the data and the site's terms. Deliberately evading a technical protection the site put in place raises legal and contractual risk. Use an official API or feed, or ask the site for access.

    No. Autonoly does not solve DataDome challenges and does not use proxies. If a DataDome challenge appears, the agent hands you the live browser; for repeated blocks, an official data source is the right route.

    Further reading

    Templates
    Blog Posts
    ← Data ScrapingDigital Transformation →

    Related terms, automations and guides

    Where this concept shows up in practice.

    DefinitionCAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response mechanism designed to distinguish human users from automated bots on websites.DefinitionCloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Enterprise bot score) that decide whether a request is automated, and answer with a 'Just a moment...' challenge or an error such as 1020.DefinitionHUMAN Security (PerimeterX)PerimeterX, now HUMAN Security's Bot Defender after a 2022 merger, is a bot-protection service that scores every request and challenges suspicious visitors with its 'Press & Hold' button, the HUMAN Challenge.DefinitionUser AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and operating system, used by websites to serve appropriate content and detect automated traffic.DefinitionRate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given time window, preventing abuse and ensuring fair resource distribution.DefinitionHeadless ChromeHeadless Chrome is Google Chrome running without a visible window. It renders pages and runs JavaScript like normal Chrome and is controlled by code, which makes it the standard engine for automated testing, scraping, screenshots and PDF generation.GuideBrowser Use Alternatives: Best No-Code Options for Non-DevelopersBrowser Use is a powerful open-source Python library for AI browser automation, but it requires coding skills. This guide covers the best no-code alternatives for non-developers who want the same AI-powered browser automation capabilities without writing a single line of Python.GuideAutomate Without API: How AI Agents Work With Any Website or AppLearn how AI agents automate websites and apps that don't have APIs. Covers browser-based automation, legacy system interaction, government portals, and how to build automations for any website — no integrations required.

    Stop reading about automation.

    Start automating.

    Describe what you need in plain English. Autonoly's AI agent builds and runs the automation for you — no code required.

    See Features