www.it-connect.fr
Google Tests Webcam Hand Scans for reCAPTCHA Verification
Wave your hand in front of your webcam to prove you’re not a robot: that’s the new method Google is experimenting with for reCAPTCHA. The stated goal is to counter AI bots that are increasingly able to beat classic tests. But Google still has work to do: just days after its appearance, the mechanism was reportedly bypassed with nothing more than a photo. Here’s what we know.
Click on the buses, click on the cars, click on the bridges... What if the challenges currently used by reCAPTCHA were soon a thing of the past? Since mid-June 2026, Google has been testing a new kind of verification for reCAPTCHA: analyzing hand gestures captured by your device’s camera.
The feature has been introduced in Google Cloud Fraud Defense, the platform behind reCAPTCHA. You’ll find it all over the web: sign-up forms, login pages, payment pages, and more. If Google wants to scan your hand to check that you’re human, it’s because AI bots are increasingly able to solve CAPTCHA challenges on their own. This can, for example, enable automatic account creation.
Table of Contents
A Short Video of Your Hand
According to Google, when the challenge is triggered, the browser requests camera access, then prompts you to perform one or more gestures, such as a wave. Google’s machine learning model then records a short video and extracts landmark data from it, namely 21 coordinates corresponding to the joints and knuckles of the hand.
This principle has a name: liveness detection. In other words, it is the ability to confirm that a real human is indeed behind the screen, something a bot has a harder time mimicking than a simple series of clicks on an image. This new verification method, currently unavailable, will remain optional: developers will decide whether to enable it on their website or not.
What Google Promises for Privacy, and the Gray Area
If Google analyzes your hand, it may also capture your face and even other elements. Naturally, this raises privacy concerns.
On paper, Google says the captured videos are never linked to the user’s identity, no audio is recorded, and the images are deleted once verification is complete. The Mountain View company also says this data is not shared with third parties and that camera access permission can be revoked at any time from the browser settings.
However, one nuance casts doubt on that claim: there are contradictions within the same page. In fact, in this case, the documentation says the collected information is used and retained in accordance with Google’s privacy policies. That would mean Google does not systematically delete the video recording: this detail gives us reason to be skeptical.
Already Defeated with an Image Found Online
According to Tom's Hardware, testers have already managed to fool the new reCAPTCHA system. Their method: feed a simple photo of someone making a hand sign into an OBS virtual camera, then point reCAPTCHA to that virtual feed. After a few adjustments to the image position, the challenge was reportedly validated.
This failure mainly highlights the context in which Google is moving forward. Traditional CAPTCHAs are being bypassed more and more often by AI-powered bots, to the point that automated traffic recently surpassed human traffic on the web, according to Cloudflare. Industry giants are therefore looking for alternatives, like the PACT protocol backed by Cloudflare, which aims to do away with CAPTCHAs altogether. Google’s gesture-based verification fits into that same goal, but clearly this mechanism is not production-ready yet, in addition to being intrusive.
And you — would you be willing to turn on your camera to prove to a website that you’re human?
