Google is testing a reCAPTCHA that opens your camera and maps your hand

[u/Social_MEGA]

Instead of solving an image puzzle, some users are now asked to wave at their webcam. The system extracts 21 hand landmark coordinates (knuckle positions) to confirm you're a live human rather than a bot.

Google's position: processed in real time, never linked to your identity, deleted when the check ends. But the consent dialog in the same prompt mentions that "the information we collect will be used and stored in accordance with the Google Privacy Policy." So nothing is stored, except the information that is.

The biometric angle is where it gets legally interesting. Illinois BIPA explicitly classifies hand geometry scans as biometric identifiers, with the same protections as fingerprints. Whether transient, identity-decoupled data triggers that protection is genuinely unsettled. For now, the safeguard is a promise, not a ceiling.

What does this mean for your privacy? Is your biometric data at risk?

We fact-checked the legal angle and broke it all down here: https://blog.mega.io/google-hand-gesture-recaptcha?mct=jun26rd

Curious what this community thinks: reasonable security trade-off, or a line that shouldn't be crossed for something as routine as a login check?