Google Selfie Video Sign-In Privacy: What Data It Stores

Google has confirmed that it encrypts and stores a user's enrolled selfie video on its own servers, rather than only on the device used to record it. That server-side storage is intentional. Google says the purpose of selfie video sign-in is to help people recover accounts after losing access to a device that holds their passkeys, so the reference video needs to work across devices.

The feature itself isn't new. Google rolled out selfie video sign-in in July as an additional way to verify identity and recover access to an account. What's new is Google spelling out in more detail exactly how the sign-in system works, what it keeps, what it deletes, and which controls users have.

Anyone who has already enrolled, or is weighing whether to, now has a clearer picture of whether the convenience is worth storing an encrypted reference video of their face on Google's servers.

How Google selfie video sign-in works and what stays on its servers

Google states that once enrollment is verified, it encrypts the reference video and stores it on its servers rather than keeping it solely on the device where it was recorded.

The company says server-side processing is necessary because selfie sign-in is designed to work across devices. If someone loses access to the device containing their passkeys, the saved reference video can still be used to verify them from another device.

Google draws a distinction between this system and the facial recognition used with a passkey to unlock a device. In the latter case, biometric information such as a face scan stays on the device and isn't shared with Google.

Those are two different authentication systems with different storage models, even though both can involve a user's face.

Google says its selfie sign-in system performs one-way matching. It can compare a new sign-in selfie against the reference video saved for a particular Google Account, but it isn't designed to take an arbitrary face and search for Google Accounts belonging to that person.

The technical and privacy descriptions come primarily from Google itself. The company says it also works with independent labs to certify its systems, but its October 15 post doesn't provide independent test results establishing the real-world accuracy of the specific anti-spoofing and face-matching claims described there.

What Google deletes and what it keeps

Two videos are involved when selfie sign-in is used, and they have different retention rules.

The enrolled reference video is encrypted and retained on Google's servers so it can be used for future verification.

The new selfie recorded during a sign-in attempt is transient. Google says it is permanently deleted immediately after face matching is complete.

Users can also delete the stored reference video through their Google Account. Removing it disables selfie video as a sign-in method without otherwise deleting the Google Account.

Deletion isn't necessarily instantaneous throughout Google's systems, however. Google's Selfie video Help Center page says a deleted selfie video is removed from the Google Account after a period of time and may be retained temporarily as a security measure.

Google also says it may retain the video for longer if the user has violated a Google policy, so deleting the reference video shouldn't be interpreted as a guarantee that every copy disappears from Google's systems immediately.

Deleting the entire Google Account also causes the saved selfie video to be deleted from Google's servers, according to Google.

There is another privacy distinction worth making. Google says a selfie enrolled for sign-in is used solely to confirm the user's identity during sign-in unless the user separately allows Google to use the video to improve its verification technologies.

That optional setting can let Google use the video and related data to develop and improve facial recognition, age estimation, and other verification methods involving physical features or movement. Users can turn that permission off later.

Google's broader selfie-video system can also serve purposes beyond account recovery. Its Help Center says selfie videos may be used when prompted to unlock certain features or services and can be used to create an avatar for AI content that looks and sounds like the user.

That doesn't mean a selfie enrolled for sign-in is automatically repurposed for those uses. Google's documentation treats these as different uses of selfie video and separately says the sign-in reference video is limited to confirming identity unless the user opts into broader improvement purposes.

Google Account selfie video verification: setup, signals, and who's excluded

Setting up selfie video for sign-in requires access to the account first. Users record a short video while signed in and follow prompts that capture their face from multiple angles.

Google says someone can't add a sign-in selfie while already locked out or going through account recovery. Its newer security explanation also says enrollment requires an existing trusted session.

Matching a face isn't treated as a standalone guarantee of identity.

Google says its sign-in risk-assessment engine considers the selfie match alongside other contextual signals and can require additional verification when a session appears suspicious.

For anti-spoofing, Google describes liveness models that look for subtle physical movements and visual artifacts, synthetic-media detection designed to identify AI-generated video, and hardware-backed integrity signals on supported devices that verify footage came from a physical camera rather than an injected video file.

Those are Google's descriptions of its safeguards, not independent performance results showing how often each protection succeeds or fails.

Some accounts can't enroll at all. Google's current Help Center documentation says Google Workspace accounts, child accounts, and Google Accounts enrolled in the Advanced Protection Program can't add selfie videos for sign-in.

Availability also isn't universal among otherwise eligible users. Google says selfie video isn't available in every region, for every account, or on every device as it continues expanding the feature globally.

Checking eligibility and managing Google selfie video account recovery

Users can check eligibility by opening their Google Account, going to Security & sign-in, and looking under "How you sign in to Google" for Selfie video.

Google also directs users to g.co/signin-selfie to check eligibility and begin setup.

Enrollment and permission to use the video to improve Google's technology are separate choices.

Users who enable the optional improvement setting can later return to the Selfie video page in their Google Account and turn "Improve Google services (optional)" off. Someone who originally declined can also enable it later.

Google hasn't publicly documented the default state of that optional control in the sources reviewed here, so users should check the setting during enrollment rather than assume it is enabled or disabled.

Google also sends security alerts when a selfie video is enrolled, used for a new sign-in, or removed. Anyone who receives one of those alerts unexpectedly should review the account's security activity and sign-in settings.

For people who would rather not store a reference video of their face on Google's servers, selfie video isn't mandatory.

Google recommends passkeys for all users and 2-Step Verification for additional protection. Recovery contacts, recovery phone numbers, and recovery email addresses provide additional ways to regain access.

Google recommends its Advanced Protection Program for people at high risk of targeted attacks. Accounts enrolled in that program currently can't add selfie videos for sign-in.

Whether selfie video sign-in is worth enabling comes down to a clear trade-off: device-independent account recovery in exchange for an encrypted reference video of your face being retained on Google's servers.

The temporary selfie recorded during an actual sign-in has a much shorter lifespan, with Google saying it is permanently deleted immediately after matching. The enrolled reference remains until it is removed, and Google's Help Center makes clear that deletion can involve a retention period for security or policy-enforcement reasons.

Check g.co/signin-selfie before assuming the feature is available for your account. If the recovery benefit doesn't outweigh the server-side storage trade-off, Google's other sign-in and recovery options remain available without enrolling a selfie video.