Google selfie sign-in lets users recover accounts with a face video
Google now lets eligible users set up selfie-based account recovery, with encrypted video storage and limits for higher-security accounts.
By James Whitfield · Staff Writer
3 min read
Google selfie sign-in is now available as a new way for eligible users to get back into their accounts if they lose access, according to Google. The option adds facial verification to existing recovery methods such as backup codes and recovery contacts.
The feature has to be set up before a user is locked out. Google says it is not available for Workspace accounts, child accounts or accounts enrolled in its Advanced Protection Program.
How does Google selfie sign-in work?
To set it up, users record a video of their face with a phone or computer camera while following prompts to move and look around. Google says that recording lets its systems map the user’s face so a later selfie can be compared with the original video during account recovery.
When a user tries to sign in with the feature, Google asks for another selfie-style video and head movement to check that the person is present. Google says the system then compares the new capture with the stored video to verify identity.
Google says it may ask users to refresh their selfie videos from time to time. The company also says users can delete the stored video from their account settings at any time.
What does Google store?
Google says the setup video is stored on its servers and kept encrypted. The company’s sign-in page says the video will not be used for other purposes unless the user chooses to allow that use.
Ars Technica reported that the setup flow includes an optional control allowing Google to use the selfie video to improve facial recognition technology. A Google spokesperson told Ars Technica that opting in is not required for account recovery and that Google will not use the video for anything else if the user leaves the option off.
Google says selfie videos can also be used to verify age for some account features and to create an AI avatar. Those uses are separate from the basic account recovery function described by the company.
Why are some accounts excluded?
Google says accounts in the Advanced Protection Program cannot use selfie sign-in. That program is designed for users who face higher risks, and Ars Technica noted that it requires security keys, limits third-party app access and adds more Gmail scanning to detect phishing.
The exclusion points to a security trade-off. Google says it uses multiple layers of protection to detect deepfakes, while Ars Technica noted that AI tools can create face-swapped video, including near real-time output that could be relevant to account recovery attempts.
For users who are comfortable giving Google a stored face video, the company says setup takes only a few minutes. For users who prefer stronger account protections, Google’s existing recovery tools and Advanced Protection remain separate options.
This story draws on original reporting from Ars Technica.