Google Tests Camera-based Hand Gesture Verification for reCAPTCHA

Google is trying out a new way to tell humans apart from bots. It may involve waving your hand at a camera.

The company recently introduced a feature called Hand Gesture Verification. It is a new option within its reCAPTCHA service.

Instead of asking users to identify traffic lights or buses, the system requests camera access. It then asks users to perform simple hand movements.

Why Google is making this change

For many years, CAPTCHAs have been the first line of defense against spam and fake accounts. But with artificial intelligence becoming more advanced, these challenges became far less effective. Modern computer vision models can now solve many image-based CAPTCHA with high accuracy.

Some researchers reported success rates of up to 100% against older designs of CAPTCHA. This forces security teams to find new solutions. A challenge that is easy for humans but difficult for machines is much harder to create now that machines are becoming better at understanding texts, images, and patterns.

Hand gesture verification introduces something different. It asks for a real-world physical action. While traditional analysis involves just pictures, in this case, the system will be analyzing motion through a live camera feed rather than a static image. This somehow introduces even more challenges for automated tools that rely on just a screenshot or AI image recognition.  

How the new system works

As stated in Google’s documentation, users who encounter the new method will be asked to grant temporary camera access through their web browser. Once permission is given, the system records a short video of the user’s hand.

Users perform one or more simple gestures. Google then analyzes the movement to determine if a real person is interacting with the website. The company says the system extracts “hand landmark” data from the video. These landmarks represent key points on the hand. This includes 21 coordinates of the finger knuckles.

The system uses these points to track movement and position. Google says audio is not recorded during the process. The company also states that videos are deleted after verification is complete. These features are not linked to the user’s identity.

As of today, there has been no official statement from Google regarding the rollout of this feature on a larger scale. It remains unclear how many websites are currently testing it.

Privacy questions emerge

Privacy advocates are up in arms over this feature after Google’s announcement. Granting camera access for many people feels much more invasive than asking users to select a number or find a picture of a bicycle.

Google says the system only records a user’s hand and deletes the footage once verification is complete. Critics point out that users have little ability to independently verify those claims.

Some privacy experts question whether hand images could contain biometric information. These details might uniquely identify individuals. Google has not indicated that the system collects or stores fingerprint data.

Its documentation focuses on hand landmark coordinates rather than detailed hand images. Even so, concerns about data collection are likely to follow any technology that requires camera access. Some users on social media have openly criticized the new approach, describing it as “creepy”.

Accessibility remains a concern

Another area of discussion involves accessibility. Google says hand gesture verification is optional. Existing image and audio alternatives will remain available.

The company has claimed that the new design is to complement current methods and not to replace them. But accessibility advocates have reservations.

For people who may not have a working camera or be able to physically express a specific gesture with their hands, it will be critical for alternative verification methods to remain available if the feature rolls out to a larger audience.

The tension between security and accessibility is a recurring theme for Google. In Android 17, the company is blocking non-accessibility apps from using the accessibility API, prioritizing malware prevention while raising concerns about the impact on legitimate accessibility tools.

The latest step in an ongoing battle

The history of CAPTCHA is really just a game of cat and mouse. Create a new challenge, and someone finds a way to beat it.  Text-based CAPTCHAs were broken. Image CAPTCHA became easier to solve. More advanced behavioral systems have also faced attempts to bypass them.

Google seems to be testing this hand gesture verification as part of its attempts to stay ahead of the competition in the ongoing AI advancement. Will this feature become something we all see every day when we’re online?

Hard to say. But one thing’s obvious: as AI gets smarter, security companies have to keep changing how they tell humans and bots apart. At this point, you might just have to wave at your webcam to prove you’re real.