If you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally.
To be illegal the website must be run by a business which employs 15 or more full-time employees. Or the business is some form of public accommodation like a hotel. From what I have read.
Of course it would be better to make sure the website is accessible, but I'm mostly commenting on the statement that it is illegal.
https://www.businessnewsdaily.com/10900-ada-website-requirem...
[1] https://www.businessnewsdaily.com/10900-ada-website-requirem...
They even have a compliance tester.