Overview
- Google has rolled out a limited, optional reCAPTCHA experiment that turns on a user’s webcam, asks for simple gestures such as a wave or open palm, and extracts 21 hand-landmark coordinates using the same MediaPipe landmark scheme.
- The system records a brief video clip to run a machine-learning check and then uses that hand-landmark data to decide whether the user is human while offering a fallback to traditional visual or audio puzzles.
- Independent testers quickly bypassed the check by feeding a static stock photo of a hand through an OBS virtual camera and passing the challenge without a live person or motion, calling its current resistance to scripted attacks into question.
- Google’s documentation says videos are deleted after verification, no audio is recorded, and clips are not tied to identity, but the page also points to the Google Privacy Policy for collected data which leaves retention and use unclear.
- The test comes as web bot traffic has surged and industry players have proposed cryptographic alternatives such as Private Access Control Tokens to reduce user friction and privacy exposure from camera-based checks.