YouTube Is Asking Users to Enroll in a Biometric Database to Stop Deepfakes

Key Takeaways

• YouTube announced on May 18, 2026, that its Likeness Detection tool will expand to all users over 18, up from a previous rollout limited to monetized creators, journalists, and politicians.
• To enroll, users must submit a government-issued ID and record a selfie video, which YouTube stores as a biometric face template for up to three years.
• The system scans every newly uploaded video on the platform, detecting faces of non-enrolled users in the process before discarding that data, according to YouTube.
• YouTube also offers an optional consent for Google to use enrolled face and voice data to train and improve its AI models.

When the Cure Requires a Face Scan

Deepfake technology has become genuinely dangerous over the past two years, with convincing facial swap tools now accessible to anyone with a laptop. YouTube's answer, announced May 18, is to expand its Likeness Detection tool to every adult on the platform. Previously limited to monetized creators, then opened to journalists and politicians in early 2026, the feature is now rolling out to all users aged 18 and over in the coming weeks.

The enrollment process is straightforward in the way that collecting your biometrics always sounds straightforward. You open YouTube Studio, navigate to Content Detection, upload a government-issued ID, and record a brief selfie video. YouTube uses that video and images from your existing uploads to build a facial template, which it then runs against every new video uploaded to the platform to check for unauthorized AI-generated depictions of your face. Spokesperson Jack Malon confirmed that despite the tool being framed as creator-focused, any adult can enroll.

What Google Actually Collects

The Likeness Detection help page is worth reading in full because the data picture is more detailed than the announcement suggests. Your government ID is stored in your Google Payments Profile. Your selfie video, your full legal name, and your facial template are stored in YouTube's internal database for up to three years from the last time you signed into YouTube. When you submit a removal request, a screenshot from that selfie video may be shown to YouTube's operations team to help them identify you in the flagged content.

There is also an optional consent buried in the enrollment flow. YouTube can use your face and voice templates to "develop and improve likeness detection models," meaning to train its AI. You can opt out of this at any time, but the default at enrollment is to ask you to agree.

And while YouTube says it deletes your biometric data when you turn the feature off, there is a gap of up to 24 hours between opting out and the system stopping its scans, with deletion following on its own schedule after that.

The Infrastructure Nobody Asked About

To find enrolled creators' faces, the system scans the faces of all individuals in every uploaded video, including people who never signed up and, per YouTube's own documentation, including children.

YouTube says it discards nonmatching data immediately, and I have no specific reason to doubt that claim today. But the claim rests entirely on trusting that the system works exactly as described, that it will never be amended, and that Google's data handling practices remain unchanged across the full three-year retention window. That is a significant quantity of trust to extend to a company whose business model is built on biometric data collection and behavioral profiling.

Biometric data is categorically different from other personal information. A leaked password can be changed. A leaked facial template cannot. Once a face scan is extracted from a database, the underlying biometric is permanently compromised, which is why the centralization of this kind of data carries risks that ordinary account credentials do not.

Google is now building, at genuine scale, a database that links government IDs to facial templates for hundreds of millions of users. The history of centralized credential databases being breached is long enough that treating this as a theoretical concern is difficult to justify. And when that biometric data inevitably leaks and the hackers have free access to all of the victims’ most sensitive accounts, well, they’re in for a ride, and not the fun kind of one.

The Price of Protection Is a Government ID and Infinite Trust

YouTube announced this feature in September 2024 with language about empowering creators and responsible AI development. The deepfake problem it is trying to solve is real, and the intent to give ordinary users a tool to remove unauthorized AI-generated content is genuinely useful. I will not pretend otherwise.

But the specific implementation YouTube has chosen means that solving your deepfake problem requires building Google's biometric database for them. You hand over a government ID and a face scan, Google stores both for up to three years under terms it controls and can update, and in exchange you get the ability to flag videos for review under a removal policy that YouTube itself administers.

The people with the least leverage in this arrangement are the users. If YouTube wanted to offer genuine protection without a biometric database attached, it would be worth asking who exactly benefits from the current design.