Can you imagine how complicated this is, and controversial?

How to do this exactly? Do you want Google to be proving who people are by fingerprints, irises? Google has never gotten into this business. There would be so many issues. And is collecting biometric info an absolute bulletproof way to verify identity? And doesn't have pitfalls compared to current system?

Then how about just ID documents? Who would provide the locations to verify these documents? How many hundreds of types of documents would be suitable to prove identity? And thousands of locations would be necessary to serve everyone. Would they be honest / absolutely trustworthy?

Do you know how many people out there are waiting to try impersonating people by forging documents, given the money at stake, and how many outlets (that you'd have to employ as verification agents) would be susceptible to corruption to defraud people who'd relied on these documents as proof of their identity (and keys to their online accounts)? If you register with an identity document, and that becomes your method of proof, what if someone located in another country asserts that they're you with some different form of a document that says your name on it?

It's extremely complicated.

Google is already in the payments business, which requires a significant amount of identity verification. They aren't at the level you're describing, but they're also not completely new to the business of verifying IDs, albeit via uploaded photographs rather than physical kiosks.

Yesterday I opened an online account at a bank, using my phone. The website asked me to take clear pictures of my ID card, and then record a selfie video doing a few movements and saying a few numbers. Done, in literally 5 minutes. Then of course regular logins are done with a password and 2FA, it's not like I have to show my ID every time, but I suppose if I got locked out of my account it's what they would use to identify me.

If banks can do it I don't see why Google can't. For many people, getting locked out of a Google account where they hold all their photos, connect to people via email, have their purchased Android apps, etc. is not much better than getting locked out of a bank account (depends on how much money on the account, I guess, but in many cases this is so).

the point that no one generally knows your IBAN number or calls the customer service - reset this account by telling this is my new ID card as I lost my previous ID.

Whereas your google email is known to many. What happens if some one photoshops a ID and says it is you?

Further more how should the ID prove I am the owner for john.doe@gmail?

It doesn't matter how complicated it is, given how critical a google account can be in a person's life, Google has an obligation to make a good faith effort to resolve issues like these, and if that obligation is not expressed in their terms of service, then legislatures and regulators should compel them by force of law.

The fact is that Google is already in the business of authenticating identities and actually does so in circumstances where the law compels them to, but they have deemed it too expensive to do so in the context of recovering accounts, where they remain uncompelled.

As it stands, the GDPR compels Google to make a meaningful attempt to authenticate whether you are the legitimate account holder when you submit an SAR or Data Deletion Request. But, Google, under no circumstances will attempt to identify you if you fail or are deemed ineligible for their automated account recovery process, unless you are eligible for their "In cases of nepotism or media pressure" emergency account recovery procedure.

Well, wait a second, I think you're going too far. Just because maybe you use Google to a very dependent level in your life, doesn't make it a public good that people have an entitlement to and suddenly you place legal obligations on them.

Your email is not your identity, and your particular email address is not a right. If Google has made available options to secure your email address, what exactly are you entitled to compel Google to do that does not conflict with the security decisions they've also made to protect your account from fraud?

> Your email is not your identity

Google seems to disagree https://developers.google.com/identity/gsi/web

The paradigm of 18th century economic theories, which I doubt that you sincerely subscribe to excepting this one matter, is no longer relevant. When the power wielded over, and the access afforded to an individual by a private corporation is so great that when denied access that person has no meaningful alternative and is meaningfully and irreparably harmed, that does become a matter of public concern. Whether or not users were informed when signing up that google would come to hold the keys over almost the entirety of their identity as it exists on the internet, and that their identity on the internet would come to represent a huge fraction if not the majority of their identity in the world, that is the circumstance we find ourselves in. Our identity on the internet is for most, an essential and non-negotiable element of the infrastructure of the modern world. A person who loses access to that identity may very well be losing access to their only means of employment and their only means of communications with certain friends and family members, and documents that are critical to their freedom and identity in the physical world (scans of passports, birth certificates, vaccination cards.)

The fact is that these corporations are not innocently providing simple little services that users might occasion to use for a bit of time and then freely put down; they provide services that grant them at times more power than nation states over the lives of individuals who are completely powerless to respond. Given that they wield power over a service which is not optional for most of their "clients", whether or not they meant to (they meant to), they are providing a public good. And if they are unwilling to do so in a way that aligns with the values of the citizens of ostensibly democratic nations, then the citizens of those nations should vote to either compel them to offer their services in alignment with the public good or have their property and right to conduct business in that nation seized.

And whether or not many are aware of it, this would not represent a sea-change in policy for any Western government that I know of. This would simply be the very late, but reasonable extension of more than a century of well-established legal precedent that already exists. For example, in the United States, we call corporations that are regulated in such a manner "Public Utilities", in Germany they are called "Öffentliches Versorgungsunternehmen" and in France they are called "Entreprises de Services Publics" and in Spanish they are called "Empresas de Servicios Públicos"