Google Tests reCAPTCHA That Requires Showing Hand

Google is testing a new reCAPTCHA challenge type, hand gesture verification, as part of its Cloud Fraud Defense product. Per Google's own documentation, when the check triggers, reCAPTCHA requests webcam access and prompts the user to perform gestures such as a wave; a machine learning model then extracts hand landmark data, mapping 21 hand-knuckle coordinates (the same landmark scheme used by Google's MediaPipe hand-tracking model), to help decide whether the user is a real person. Android Authority first reported the test on July 2, 2026. Users who cannot or do not complete the gesture challenge fall back to the standard visual and audio puzzles, and Google says the feature is meant to work alongside, not replace, those existing options.

Google's documentation states that captured videos are never associated with a user's identity, that audio is never recorded, and that videos or images are automatically deleted once the challenge completes; it also notes that whatever data is collected is otherwise "used and stored in accordance with the Google Privacy Policy," language Android Authority flagged as leaving some ambiguity about retention. Separately, Tom's Hardware reported that testers were able to defeat the check by playing a stock photo of a waving hand through an OBS Virtual Camera, tricking the system into treating a static image as a live gesture.

This is a textbook liveness-detection failure mode: gesture or landmark extraction alone doesn't prove a live camera feed, and systems that skip depth, motion-continuity, or challenge-response checks are vulnerable to simple replay attacks. Teams building or buying bot-detection, KYC, or biometric-verification tooling should treat "we track hand landmarks" as necessary but not sufficient, and should specifically test replay and static-image spoofing before trusting a gesture check as a security boundary.

Whether Google tightens the anti-spoofing logic, for example by requiring depth signals or randomized multi-step gestures, before any wider rollout, and whether the feature moves from a live test into reCAPTCHA's default challenge set. As of this writing, Google has not said how broadly or in which regions the test is running.