Google's New Selfie Login: A Convenience for Some, a Risk for the Rest
AI-generated image · Bay Street Wire
The tech giant's latest account recovery feature prioritizes ease of access while leaving the door open for deepfakes and the risks of centralized facial data storage.
OPINION: Google's new selfie login treats biometric data as a convenience, but storing a video record of your face on corporate servers opens the door to deepfakes and privacy trade-offs that warrant scrutiny.
In a move that prioritizes frictionless access over robust security, Google has introduced a feature allowing users to regain account access via a selfie video. As reported by Ars Technica senior technology reporter Ryan Whitwam on July 23, 2026, the system requires users to record a video of themselves looking around to map their face, which Google then stores on its servers. This biometric data can be used for account login, age verification, and the creation of AI avatars.
While Google promises that these videos are encrypted and will not be used for other purposes unless a user opts in, the company does include an optional toggle during setup. According to Ars Technica, this toggle allows Google to use the selfie videos to improve its facial recognition technology. A Google spokesperson confirmed to Ars Technica that this is not a requirement for using the recovery feature and that videos will not be used for other purposes if the box remains unchecked.
However, the security of this method is questionable. Ars Technica notes that the rise of AI makes it possible to create deepfake videos, potentially in near real-time, which could be used to bypass this recovery system. While Google claims to have multiple security layers to detect these deepfakes, the company's own restrictions suggest the feature is not a top-tier security measure. Notably, Ars Technica reports that Google has explicitly barred users enrolled in its Advanced Protection Program—which requires security keys and stricter phishing scans—from using selfie sign-ins.
Access to this feature is further restricted by account type. Ars Technica reports that selfie sign-ins are unavailable for child accounts and Workspace accounts. While Google states that users can delete their videos from servers at any time via account settings, the initial collection of biometric data remains a point of concern for anyone wary of handing their likeness to a tech giant.