Google would like footage of your face. As of this week, the request appears right on its home page.
A banner at the foot of the screen invites you to “sign in with a selfie,” offering two buttons: “don’t set up” and “set up selfie.” Nobody is forced into it. Still, the world’s largest search engine placing facial recognition in front of billions of visitors, without anyone asking for it, is the detail that deserves scrutiny.
The feature was first unveiled by Google in July, framed as a safety net for moments when you are locked out of your account or separated from your usual devices. Enrolling takes little time: you capture a brief video of your face while rotating your head so the camera records several angles. Later, if “you’re having trouble signing in later on,” the company said in its announcement, “you just take another selfie to get back into your account.”
The new element is the marketing push. Tucking a recovery option away in account settings is one matter. Splashing it across the home page is quite another.
The selfie’s job goes beyond confirming you own the account
Study the small print on the setup page and the clip’s responsibilities multiply. According to a disclaimer, the video will additionally be used to work out whether you’re “old enough to use certain Google services.” In other words, the footage that gets you back into your account doubles as an age-estimation tool.
A separate opt-in appears under the label “improve Google services.” Check that box and you grant the company permission to use your video selfies to “improve our facial recognition, age estimation, and other verification methods that use your physical features or movement, across Google services.” Your face, and the way it moves, would then be training models deployed company-wide rather than just at the sign-in screen.
Why your face is a different kind of data from your search history
Google already sits on enormous stores of behavioral data about its billions of users, which it uses to refine search results and sell targeted advertising. Stacking a mathematical representation of your face on top of that concentrates a great deal of who you are inside a single company. And unlike a password, a face cannot be reset after a leak.
Spoofing is the other open question. AI deepfake tools are steadily becoming more persuasive and easier to obtain, and nobody can say with confidence how a facial recognition scan would hold up against a determined forgery attempt. Betting on unproven biometrics for the recovery method meant to serve as your final safeguard is an odd choice.
For the moment, the sensible advice is the unglamorous kind. The “don’t set up” button does exactly what it says, and nothing in Google’s announcement indicates you forfeit anything by clicking it.