When users lose every device they own and can no longer be reached at their phone number, how can they get their digital assets back? Google has offered one answer to that question.
On July 23, 2026 (US time), Google announced that it has added "selfie video" as a new recovery method for Google Accounts. This feature serves as a backup for situations where normal sign-in methods—such as passkeys or a smartphone—are unavailable. It is designed to prevent account takeovers while still ensuring that legitimate users can reliably regain access.
In advance, users register a short video of themselves using the camera on their smartphone or PC, performing a brief motion such as turning their head from side to side. If they are ever locked out of their account, they record the same kind of video again. The system then uses AI to compare the newly recorded video against the one on file, and if it can confirm the person's identity, access to the account is restored. Setup can be done at a designated URL (g.co/signin-selfie).
The "Blind Spot" of Head-Turning That Exposes Deepfakes
The core of this feature lies in requiring a video that involves "movement," rather than simply matching still images. Instead of just comparing the shape of a face, the system demands motion within three-dimensional space, raising the bar for potential attackers.
In recent years, AI-driven deepfake technology has advanced rapidly, making it increasingly easy to forge a front-facing image of someone's face. We now live in an era where, from just a single photograph, a video can be generated within seconds that shows the person speaking in their own voice and even blinking naturally. However, generating a real-time profile view—especially one where the face is turned significantly to the side—remains a significant computational challenge for current deepfake technology. Continuously and consistently rendering the three-dimensional structure of a face and the way shadows shift over time requires an extremely high level of processing power.
By deliberately requiring the motion of "turning the head from side to side," Google places a heavy load on real-time face-swapping technology, using it as a kind of "liveness test" to determine whether the person in front of the camera is a living human being or a generated video. While Apple's Face ID physically scans a 3D map of the face using infrared dots, Google's approach relies on a general-purpose 2D camera combined with AI inference. Because it does not require a specialized depth sensor, it has the advantage of being widely usable across many devices, transcending hardware limitations—working even on inexpensive Android phones or the webcams built into older laptops.
That said, the system alone does not completely handle identity verification on its own. Google positions this video matching as part of a broader risk assessment, using additional authentication methods together with it when signs of a suspicious sign-in are detected, in order to enhance overall security. Given that open-source AI models continue to evolve and the accuracy of generating profile views will likely keep improving, how long this liveness-test approach can remain effective will be a key technical question going forward.
The Dilemma of "Device Dependency" Brought About by the Spread of Passkeys
The backdrop to Google's decision to introduce selfie video recovery at this particular moment is the rapid spread of passkeys. Traditional passwords have always carried the risk of exposure through phishing scams or database leaks, but passkeys, which use public-key cryptography, are a powerful means of cutting off that risk at its root.
Within Google's own systems, passkeys had already been used for more than one billion authentications as of 2024. The shift away from passwords appears to be progressing smoothly. However, as a byproduct of this major security improvement, a new challenge has emerged: "device dependency" of authentication keys. Passkeys are, in principle, stored in a secure area within the device itself. If a user loses the smartphone or PC where the passkey is stored, and also loses access to their recovery phone number or backup email address, they risk permanently losing everything in their account—photos, documents, work emails, and more. For Google, which continues to push the adoption of passkeys further, this scenario of "losing your phone equals losing everything" was an obstacle too significant to ignore.
Given that Google is doing away with methods that rely on something stored "in the user's memory," like passwords, it makes strategic sense to place biometric information—something a user can never lose—as the final line of defense for backup recovery. By registering a person's face, a truly unique physical characteristic, on the cloud side, users can find a path back to recovery even from the most desperate situation, where every device they own has been lost.
Ensuring Privacy for the Ultimate Form of Personal Information
Many users understandably feel uneasy about entrusting a video of their own face—arguably the ultimate form of personal information—to the cloud. In recent years, regulators around the world have taken an increasingly strict stance toward the collection of biometric data by tech companies. In response to these concerns, Google explains that recorded selfie videos are stored securely in encrypted form, and that users can delete them at any time from the settings screen, in an effort to build trust and understanding.
By default, this video is used solely for the purpose of signing into the account. Using the data for other research and development purposes—such as improving the accuracy of AI facial recognition systems or age estimation—requires the user's explicit opt-in consent. Through strict encryption of the data and tight limitations on its use, Google appears to be trying to dispel suspicions about data collection while still ensuring convenience. By making users' control over their own data clear, the company aims to ease the psychological resistance people may feel toward storing biometric information in the cloud.
The end of the password era also marks the beginning of an era in which we entrust our very bodies to corporations as keys. How well can a recovery system built on biometric data withstand increasingly sophisticated social engineering and AI-generated impersonation attacks? The robustness of this "last key" will be the true test of a passwordless society's ability to strike a balance between convenience and security.