The Internal Revenue Service will require people who access and pay their taxes online to enroll in a third-party facial recognition company starting this summer (h/t Krebs on Security). Even those who have already registered on IRS.gov with a username and password will have to provide a government ID, a copy of a utility bill, and a selfie to ID.me, the Virginia-based identity verification company. You’ll take a video selfie with whatever webcam or mobile device you’re using to sign up, which seems likely to cause problems for people with older hardware or who don’t have access to one.
According to the IRS, ID.me is a “trusted technology provider” of identity verification services. Anyone who already has an ID.me account from another government agency can sign in with those credentials. Brian Krebs created a new ID.me account and wrote in his post that the sign-up process was time-consuming and glitchy. He got stuck about halfway through the process and had to start again from the beginning, then was prompted to join a video call with an ID.me representative — with a wait time of nearly three and a half hours.
In its “privacy bill of rights,” ID.me says it doesn’t “sell, lead, or trade biometric data to any third parties or derive any profit from the sale, lease or trade of biometric data.” It can share information with its partners with users’ explicit permission, according to its website, and when you register for an ID.me account, you have to accept the company’s biometric consent policy. The company collects facial and voice biometrics to verify identity and protect against fraudulent behavior and to “comply with a request from law enforcement or government entities where not prohibited by law.” And even if you delete your ID.me account, the company may retain your biometric data for several years, depending on “the nature of the data and relevant legal or operational retention needs.”
You may remember ID.me from earlier in the pandemic; more than two dozen states use the company to verify people applying for unemployment benefits. Motherboard reported in June 2021 that ID.me failed to identify some applicants and that they had difficulty reaching anyone at the company to remedy their problem. ID.me CEO Blake Hall told The Verge at the time that it uses a system similar to Apple’s FaceID or the way a TSA agent would compare a passenger’s face to their ID at an airport.