The feature is designed for situations where people have forgotten passwords, lost a device or cannot use their usual two-factor authentication method. It adds facial verification to Google’s existing recovery choices, which include registered telephone numbers, recovery email addresses, backup codes, trusted devices and designated recovery contacts.
Users must enrol before losing access to their accounts. The option cannot be activated while an account is locked or after the recovery process has begun, making advance setup essential. Availability is being expanded through a phased global rollout, and the feature may not immediately appear for every account.
During enrolment, the user records a short video while following prompts to move their head. The guided movements capture the face from multiple angles and help Google establish that the footage shows a live person rather than a static photograph.
The reference video is encrypted and stored in Google’s cloud systems. When the account holder later needs to verify their identity, they record another video. Google compares the new footage with the saved recording and checks whether the person is performing the requested movements in real time.
The company said several security layers are used to identify impersonation attempts, manipulated footage and deepfake videos. Its broader risk-based security systems may also examine factors such as the device, location and circumstances surrounding a sign-in attempt before restoring access.
A successful facial match does not necessarily mean every attempt will automatically be approved. Suspicious activity can trigger additional checks, reflecting the challenge of balancing straightforward account recovery with protection against takeover attempts.
Users retain control over the stored recording and can delete it through their Google Account. The video is intended only for sign-in and recovery unless the account holder separately agrees to additional uses. Removing it would also remove the selfie video as an available recovery method.
The addition addresses a persistent weakness in digital security. Stronger authentication methods can make accounts harder to compromise, but they can also leave legitimate owners stranded when a telephone is stolen, an authentication application becomes unavailable or a passkey is stored on an inaccessible device.
Research into multi-factor authentication has found that many users could lose access after losing a single authentication device. Security studies have also highlighted account recovery as a potential attack route because a weak recovery process can undermine otherwise robust password and multi-factor protections.
Selfie verification gives users an additional recovery path that does not depend on possession of a specific telephone, security key or trusted device. It could be particularly useful for people whose Gmail, Google Photos, Drive documents, calendar appointments and other services are tied to one account.
The approach nevertheless expands Google’s use of biometric information, raising questions about data retention, consent and the consequences of a security breach involving facial data. Unlike a password, a face cannot easily be changed after biometric information has been exposed.
Google’s emphasis on encryption, deletion controls and opt-in consent is intended to address those concerns. Privacy specialists are still likely to examine how facial templates are generated, how long operational data is retained and whether users fully understand any optional permission for uses beyond account access.
The spread of generative artificial intelligence has also complicated facial authentication. Convincing synthetic images and videos can now be produced with widely available tools, increasing pressure on technology companies to distinguish live users from fabricated or replayed footage.
Liveness checks seek to reduce that risk by requiring unpredictable movements and analysing signs that a recording is being created at that moment. Such systems are not infallible, and their effectiveness depends on how they respond to improving deepfake techniques, poor lighting, camera limitations and changes in a user’s appearance.
Google is presenting the feature as an additional safeguard rather than a replacement for established security measures. Users are still encouraged to maintain more than one recovery option, keep recovery contact details updated and retain backup codes in a secure location.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
