Server side validation for reCAPTCHA V2 or Invisible reCAPTCHA with Java (Servlet)
One small criticism of you're code that I'll offer is that the loop in the middle which reads a stream could be usefully factored out and put in a general utility.  Reading a stream is a common problem and could be made more general.

In fact I have a small routine to do that sitting here on my hard drive.  Here's my version:

public class IoUtils
{

   private IoUtils() {}

   public static CharSequence readFully( Reader reader )
           throws IOException
   {
      char[] buffer = new char[ 1024 ];
      StringBuilder stringBuilder = new StringBuilder();
      for( int length; ( length = reader.read( buffer ) ) != -1; )
         stringBuilder.append( buffer, 0, length );
      return stringBuilder;
   }

   public static ByteArrayOutputStream readFully( InputStream ins )
           throws IOException
   {
      ByteArrayOutputStream bos = new ByteArrayOutputStream();
      byte[] bytes = new byte[ 1024 ];
      for( int length; ( length = ins.read( bytes ) ) != -1; )
         bos.write( bytes, 0, length );
      return bos;
   }
}


Use it something like this:

    InputStream res = new URL(url).openStream();
    BufferedReader rd = new BufferedReader(new InputStreamReader(res, Charset.forName("UTF-8")));

    CharSequence cs = IoUtils.readFully( rd );

    JSONObject json = new JSONObject( cs.toString() );


Reading a stream as UTF-8 is so common you might even want to make a separate method just for that.  Then you could do

JSONObject json = new JSONObject( IoUtils.readFullyUtf8( 
         new URL(url).openStream() ).toString() );


Some might find a single line of code more clear to read.