It is extremely disappointing to see Reclaim’s reporting whiff so badly on this. Yeah, they got the gist of the outrage, but they missed the real grift underneath. They slipped a massive loophole under the radar here and Reclaim misses it entirely: Google promised to delete the footage, but not the data derived from the footage. To use 23andme as an analogy, the company tended to dispose of old genetic sample kits after a while, but retained the derived data from those kits identifiably associated with specific people. Google is only promising to dispose of the costly data to store, the raw biometric material that takes up precious terabytes, but unlike 23andme will never voluntarily permit you to review and remove the results of their biometric analysis if you. Reclaim, if you’re reading this, here’s what you missed: https://docs.cloud.google.com/recaptcha/docs/hand-gesture-ve...

> Google does not retain any images or videos of a user's hand gestures

This is the sole statement of data deletion provided, and nowhere does Google state any other retention policy for derivations whatsoever, whether anonymized or associated, from that hand data; referring instead to the generic terms of service privacy policy:

> Other data is deleted or anonymized automatically

The privacy policy does not have a specific callout for biometric derivations, and so they may choose to anonymize rather than delete your biometric data.

> some data we retain for longer periods of time when necessary for legitimate business or legal purposes, such as security, fraud and abuse prevention

Recaptcha exists for the exlclusice purpose of security, fraud and abuse prevention, and so by this clause they may retain your identified hand scan biometrics for as long as they see fit.

> We will share personal information outside of Google if we have a good-faith belief that disclosure of the information is reasonabl[e]

They will give your identified hand biometrics upon request to anyone who can make a convincing case to them.

> We may share non-personally identifiable information publicly and with our partners

And they grant themselves the right to start selling their dataset of humanity’s hand biometrics for personal profit with none shared back to those whose biometrics are now a commodity to be bought and sold.

(Note that Google is not alone in this; see also gestures at much of tech. But that’s no excuse for the grift going unreported by a journalistic entity that’s been around long enough to know better how these reassurance-by-omission scams work. I was already upset with Google but I still expect better of those trying to stop them.)

Google's New reCAPTCHA Wants Your Camera Access and 21 Points of Your Hand