Google is testing a new reCAPTCHA that doesn't ask you to click fire hydrants or type warped letters. It asks for your camera.
Some users are now seeing a prompt that requests camera access and asks them to perform a simple hand wave to prove they're human. The system captures a short video, analyzes 21 hand-joint coordinates to confirm the gesture, and then — according to Google — deletes the footage immediately.
What Google says it does
The new system is designed to fight a real problem: AI bots have gotten good enough to pass traditional CAPTCHAs. The hand-gesture check adds what Google calls "liveness detection" — a way to verify that a human is physically present rather than a script running image recognition.
According to Google's documentation, the system does not record audio, does not link the video to your identity, and deletes footage immediately after verification is complete.
Why people aren't convinced
Two concerns came up fast after this feature started rolling out.
First, users on X reported bypassing the check using a virtual camera and AI-generated hand animations. If that holds up, the entire premise — that gestures prove human presence — breaks down. You'd get the privacy cost without the security benefit.
Second, and more broadly: requiring camera access for routine website verification is a different category of data collection than checking a box or solving a puzzle. Even if the footage is deleted instantly, granting camera access is now framed as a normal part of browsing the web. That's a precedent worth paying attention to.
The bigger picture
This isn't an isolated product decision. Biometric verification — using physical characteristics to prove who you are or that you're human — is expanding quickly. Age verification laws in the UK, multiple US states, and Australia are pushing websites to collect more biological data from users. CAPTCHA systems are infrastructure, and when that infrastructure shifts toward cameras and physical gestures, it normalizes the model for everything built on top of it.
What you can do
Look for alternatives. Most sites still offer a fallback. If you see a camera prompt, check for a "try a different challenge" link — it's usually there.
Use Privacy Badger or uBlock Origin. These block the trackers that often trigger CAPTCHAs in the first place. Fewer trackers, fewer prompts.
Keep camera permissions tight. Treat browser camera access like location access — grant it when you choose to, not because a verification form asks for it.
Up next · Wednesday
A look at three privacy tools from DuckDuckGo — their free email alias system that strips trackers before messages reach your inbox, an Android tool that blocks app trackers across all your installed apps, and their paid VPN.
Sources
Google Cloud documentation: https://docs.cloud.google.com/recaptcha/docs/hand-gesture-verification