The Internal Revenue Service today said that selfies collected from taxpayers will be deleted and that it has deployed a new verification option as an alternative to its controversial facial recognition system. The IRS’s use of the ID.me facial recognition service has been criticized by privacy and civil rights advocates as well as lawmakers from both the Democratic and Republican parties.
Two weeks ago, the IRS responded to the bipartisan backlash by saying it “will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts” and “quickly develop and bring online an additional authentication process that does not involve facial recognition.” Today, the IRS announced that a new option for creating accounts without facial recognition is “now available for taxpayers.”
Instead of providing a selfie, “taxpayers will have the option of verifying their identity during a live, virtual interview with agents; no biometric data—including facial recognition—will be required if taxpayers choose to authenticate their identity through a virtual interview,” the IRS said.
Creating a new IRS account still requires ID.me, so those agents are presumably ID.me employees. We ran into an error message when trying to create a new account today.
IRS: Biometric data will be “permanently deleted”
Taxpayers setting up new accounts can choose to use the ID.me selfie method that involves facial recognition technology instead. But based on today’s announcement, newly collected and previously collected images should all be deleted from ID.me’s servers.
The IRS explained:
Taxpayers will still have the option to verify their identity automatically through the use of biometric verification through ID.me’s self-assistance tool if they choose. For taxpayers who select this option, new requirements are in place to ensure images provided by taxpayers are deleted for the account being created. Any existing biometric data from taxpayers who previously created an IRS Online Account that has already been collected will also be permanently deleted over the course of the next few weeks.
The ID.me verification process used for the IRS and other agencies involves uploading a photo of an ID such as a license or passport along with a video selfie. The images are then compared against each other to verify the user’s identity. ID.me last month claimed it does not use the controversial “one-to-many” approach in which a person’s face is compared to a large database of faces, but the company later acknowledged that it uses both one-to-one and one-to-many.
“ID.me verifies identity using 1:1 face match only,” ID.me said in that clarification. “After an identity is verified, ID.me uses a specific 1:many check on selfies tied to government programs targeted by organized crime. That step is internal to ID.me and does not involve any external or government database. It occurs once during enrollment and exists to ensure a single attacker is not registering multiple identities. The 1:many step is not tied to identity verification.”
IRS will use Login.gov, eventually
The new IRS approach that lets users choose between facial recognition and a virtual interview is a “short-term solution” for this year’s tax-filing season, the agency said. Longer-term, the IRS said it “will work closely with partners across government to roll out Login.Gov as an authentication tool. The General Services Administration is currently working with the IRS to achieve the security standards and scale required of Login.Gov, with the goal of moving toward introducing this option after the 2022 filing deadline.”
ID.me uses Amazon’s Rekognition technology and says it provides identity verification services to 30 states and 10 federal agencies. Amid the recent backlash, ID.me on February 8 said it developed “a new option to verify identity without using automated facial recognition and will make this available to all public sector government partners.” That’s presumably the same option now being adopted by the IRS for this tax season.
ID.me also said it would let users “delete their selfie or photo at account.ID.me beginning on March 1.” ID.me says it has over 73 million users.
ID.me verification wasn’t required for filing tax returns, but the IRS did require it for accessing related services, such as account information, applying for payment plans online, requesting transcripts, and the Child Tax Credit Update Portal. The IRS was in the midst of a phase-in period, so ID.me verification was only required for people creating new IRS accounts. Under the original plan, people who previously created IRS accounts would have had to submit their selfies to ID.me’s facial recognition system by summer 2022.
The Electronic Frontier Foundation recently called the IRS and ID.me changes an important victory because “facial recognition is a dangerous surveillance tool. Coercing facial recognition to interact with the government is especially pernicious, as it unnecessarily forces people to give up their privacy in exchange for necessary services. Worse still, forcing people to hand their biometric data over to a third party, which is bound by fewer privacy restrictions and regulations, would have put huge swathes of the public’s personal data at risk of being misused.”
