In a major reversal, the Internal Revenue Service says it will transition away from using ID.me’s controversial facial recognition identity verification software following weeks of public controversy and criticism from privacy groups.
Starting this summer, the IRS had planned to require users attempting to access their IRS account online to submit facial recognition scans through ID.me’s third-party identity verification services. The IRS and ID.me claimed this process would have helped reduce fraud. ID.me meanwhile has come under renewed scrutiny after CEO Blake Hall admitted that, under some circumstances, the company does run user face scans against a database of faces, a fact they hadn’t made clear previously.
In the weeks since, civil liberty groups, privacy experts, and lawmakers have all called on the IRS to reevaluate its relationship with ID.me. The agency listened.
“The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised,” IRS Commissioner Chuck Rettig said in a statement. “Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition.”
The reversal comes less than one year after ID.me was awarded an $86 million dollar contract from the Treasury Department. In an email, ID.me declined to comment and told Gizmodo to refer any questions to the IRS.
“The Treasury Department has made the smart decision to direct the IRS to transition away from using the controversial ID.me verification service, as I requested earlier today,” Oregon Senator and Senate Finance Committee Chairman Ron Wyden said in a statement following the announcement. “I understand the transition process may take time, but I appreciate that the administration recognizes that privacy and security are not mutually exclusive and no one should be forced to submit to facial recognition to access critical government services.”
The IRS’s decision was welcomed by privacy groups as well. “We’re glad to see that grassroots activism and backlash from lawmakers and experts has forced the agency to back down,” Campaign Director at Fight for the Future Caitlin Seeley George said in an email to Gizmodo. “No one should be coerced into handing over their sensitive biometric information to the government in order to access essential services.”
The Surveillance Technology Oversight Board’s Executive Director Albert Fox Cahn similarly welcomed the IRS’s decision but added the revers shouldn’t have taken this long. “The IRS should never have explored this technology in the first place.” Fox Cahn said in an emailed statement. “Facial recognition is biased, error-prone, and invasive. We should never have to forfeit our face just to pay a tax bill. When government agencies use this technology, it’s a question of when, not if, this biometric data is hacked, leaked, or misused.”
The IRS’ reversal came just hours after Wyden wrote a letter to the IRS commissioner urging the IRS to end its use of facial recognition. In his letter, Wyden expressed concerns over the technology’s well-documented struggles to accurately identify women and people of color and said it was, “unacceptable to force Americans to submit to scans using facial recognition technology as a condition of interacting with the government online.”
That statement piggybacked off another letter sent by Republican senators on the Finance Committee, who called on the IRS to end its relationship with ID.me.
“There is ample evidence to be very concerned about an IRS contractor’s ability to safely manage, collect and store this unprecedented level of confidential, personal data.” the senators wrote. “The decision millions of Americans are forced to make is to pay the toll of giving up their most personal information, biometric data, to an outside contractor or return to the era of a paper-driven bureaucracy where information moves slow, is inaccurate, and some would say is processed in ways incompatible with contemporary life.”
Now, according to Fight for the Future’s Seeley George, the focus may turn to other federal agencies and at least 30 states currently partnered with ID.me. “The lawmakers who led the charge against the IRS use of this technology should immediately call for an end to other agencies’ contracts, and there should be a full investigation into the Federal government’s use of facial recognition and how it came to spend taxpayer dollars contracting with a company as shady as ID.me,” the activist said.
ACLU’s Racial Justice Project Senior Staff attorney Olga Akselrod meanwhile said other agencies should follow the IRS’s lead and stop requiring individuals to submit biometric data to access government services.
The solution to security problems created by online access points cannot be a discriminatory system that further erodes privacy and exacerbates the harms of the digital divide,” Akselrod told Gizmodo. “People should not be required to hand over their sensitive biometric data to a private company in order to receive government services. End of story.”
Fox Cahn from the Surveillance Technology Oversight Project echoed that sentiment, “We see a national consensus against facial recognition technology” Fox Cahn said. “But while Americans were right to speak out against this IRS proposal, they’re wrong to ignore how we’re scanning those applying for unemployment insurance and other benefits. No one should have to hand over their biometric data to access what they’re entitled to by law.”
Update 4:09 p.m.: Added statements from ID.me, Senator Ron Wyden, The Surveillance Technology Oversight Project, and the American Civil Liberties Union.