Google Moonshot Spinout SandboxAQ Claims an Ex-Exec is Attempting ‘Extortion’

Google Selfie Video Sign-In Arrives—But Don't Call It Face ID

Google introduced a selfie video sign-in option on July 23, 2026, giving users a new way to recover locked accounts or log in when they lack access to their usual devices. The feature, rolling out globally to eligible Google Account holders, asks users to record a short video with guided head movements—turning left, right, or nodding—to capture multiple facial angles. If locked out later, users can record another video, which Google compares against the stored reference to confirm identity.

Credit: Jonathan Johnson/Bloomberg / Getty Images

The announcement joins a broader industry shift away from passwords toward biometric authentication. But beneath the convenience lies a more complex story about how Google is approaching identity verification differently from competitors—and why that distinction matters for billions of users.

What the Selfie Video Feature Actually Does

The selfie video method serves primarily as an account recovery fallback, not a primary login mechanism. Users must set it up proactively through their Google Account settings under "Security & sign-in". The setup process requires a device with a camera and takes only a few minutes.

When a user later attempts to regain access, Google prompts for another selfie video, requiring head movements to prove liveness. The system then compares the new recording against the stored reference. Google says it uses "multiple layers of security" to detect impersonation attempts, including fake photos and deepfake videos.

However, Google acknowledges that passing a selfie video "alone may not always be sufficient" to recover an account. The company evaluates overall risk and may require additional verification methods depending on the situation.

Not All Accounts Are Eligible

The feature comes with notable restrictions. It does not work for Google Workspace accounts, children's accounts, or any account enrolled in Google's Advanced Protection Program. Advanced Protection, Google's highest-security tier, requires physical security keys and restricts third-party app access. The exclusion suggests Google itself does not consider selfie video verification as secure as its strongest authentication options.

Why Liveness Detection Matters Now

The timing reflects a specific threat: AI-generated video is becoming increasingly convincing. "Liveness" checks—confirming a real human is present rather than a bot, photo, or doctored video—are becoming baseline requirements for companies handling logins, payments, or sensitive data.

Google requires users to perform simple movements during both setup and sign-in attempts. This is designed to prevent replay attacks using static images or pre-recorded videos. The company also applies its standard security practices to detect suspicious sign-in attempts.

Privacy and Biometric Data Concerns

The feature inevitably raises privacy questions around biometric data collection, an area regulators have increasingly scrutinized. Google says selfie videos are encrypted at rest, stored securely, and used only for sign-in purposes unless users opt in to share them for additional uses. Users can delete their selfie video from their Google Account at any time.

But the fine print warrants attention. An optional toggle in the setup flow allows Google to use the selfie video to improve its facial recognition, age estimation, and other verification methods. A Google spokesperson confirmed this is not required to use the feature, and the company will not use the video for other purposes if users leave the box unchecked.

Security experts generally agree that live video provides more valuable identity verification data than still photos, because motion, depth, and microexpressions help confirm humanity. However, some experts warn that video verification systems can be tricked by sophisticated deepfakes. Ricardo Amper, CEO of identity verification company Incode Technologies, noted that AI-generated faces can already blink, turn heads, and respond to prompts with convincing motion.

A Different Approach From Apple's Face ID

Google's selfie video sign-in is frequently compared to Apple's Face ID, but the two serve fundamentally different purposes. Face ID uses infrared projectors and cameras to create a 3D facial map, operating quickly and reliably in most lighting conditions. It functions as a primary, daily authentication method.

Google's selfie video, by contrast, is a cloud-based recovery tool that relies on standard camera video, AI analysis, and movement prompts. It does not require specialized infrared hardware, making it available to a much wider range of devices. But this broader compatibility comes with trade-offs: it may be more vulnerable to sophisticated spoofing attacks than hardware-based 3D facial recognition.

What This Means for the Passwordless Future

Google has been pushing toward a passwordless future through passkeys, which let users sign in using device screen locks, fingerprints, or facial scans stored locally. Passkeys are considered phishing-resistant because biometric data never leaves the device.

The selfie video feature represents a different philosophy. Rather than relying on device-bound biometrics, it stores facial data in the cloud as a recovery parachute. Google told The Register it expects most users will prefer passkeys for regular sign-ins and use selfie video primarily when they lose their phone or the device containing their passkey.

This creates an interesting dynamic: Google is simultaneously pushing users toward more secure, device-bound authentication while also building a cloud-based biometric fallback that could become a target for attackers. The company's willingness to exclude Advanced Protection users from the feature suggests it understands this tension.

The Broader Implication

The most important thing about Google's selfie video sign-in isn't the technology itself—it's what the feature reveals about Google's identity strategy. Unlike Apple, which tightly couples biometric authentication to specific hardware, Google is building identity verification that works across devices and can recover accounts even when all trusted devices are lost.

This approach is more practical for Google's ecosystem, which spans Android, Chrome, Workspace, and countless third-party services. But it also represents a bet that cloud-based biometric verification can be made secure enough for mainstream use—a bet that will be tested as deepfake technology continues to improve.

For users, the feature offers genuine value: a backup option when other recovery methods fail. But it also requires a calculation about trust. Google stores your facial biometric data in the cloud, encrypted but accessible across devices. The company says it won't use the data without permission, but the optional toggle for improving facial recognition technology means users should read the fine print carefully.

What Happens Next

The feature is available now to eligible Google Account users. Google may ask users to update their selfie videos periodically. The company previously tested the feature in Brazil.

As AI-generated video becomes more sophisticated, Google will need to continuously improve its liveness detection to stay ahead of attackers. The company's decision to exclude Advanced Protection users suggests it may eventually offer a more secure version of the feature, possibly incorporating additional verification layers.

For the broader industry, Google's move reinforces that biometric authentication is no longer optional for consumer-facing services. The question is no longer whether companies will adopt biometric verification, but how they will balance convenience, security, and privacy in an era of increasingly convincing AI-generated content.