The IRS will move away using ID.me's facial recognition verification for IRS.gov

The IRS said it would stop using the third-party facial recognition service ID.me after Insider and others reported concerns about the technology.

• The IRS will eventually stop using ID.me identity verification on IRS.gov accounts, the agency said on Monday.
• The IRS signed an $86 million contract with ID.me last year.
• ID.me uses facial recognition and stores lots of sensitive data about users, which Insider reported can be easily tapped by police.

The IRS is "in the process of transitioning away" from using the third-party verification service ID.me for IRS.gov accounts, the agency said on Monday.

ID.me uses facial recognition for identity verification, and has been criticized by users and Congress for its business practices, privacy concerns, and for making it difficult for Americans to access their tax documents.

The IRS's decision to stop using ID.me came mere hours after Senator Ron Wyden of Oregon, chair of the Senate Finance Committee, sent a letter to the IRS urging the agency to end its use of ID.me for IRS.gov accounts. The decision also followed reports on ID.me from Insider, Bloomberg, and Cyberscoop, which highlighted privacy and user concerns about the company.

27 states still use ID.me for identity verification on people trying to access unemployment benefits. The Department of Veterans Affairs also uses ID.me for identity verification on some people trying to log into their VA.gov accounts.

The IRS declined to answer Insider's questions about when exactly it plans to finish transitioning away from ID.me. The IRS said in a statement that it would "quickly develop" another identity authentication tool that "does not involve facial recognition."

Last year, the Department of the Treasury signed an $86 million contract for ID.me services through 2023.

In his letter to the IRS this morning, Wyden argued that since the IRS doesn't require facial recognition for people to file their taxes, the IRS shouldn't require it in order to access any specific IRS services. His office released a statement after the IRS announced it would stop using ID.me in the future.

"The Treasury Department has made the smart decision to direct the IRS to transition away from using the controversial ID.me verification service, as I requested earlier today," Wyden said in the statement, released Monday. "I understand the transition process may take time, but I appreciate that the administration recognizes that privacy and security are not mutually exclusive and no one should be forced to submit to facial recognition to access critical government services."  

Last week, Insider reported how law enforcement could easily request sensitive information that ID.me stores (like "inferred citizenship" for people who submit passports, as well as selfies, voiceprints, and information from other government documents). 

Bloomberg also recently reported that some people have struggled to get unemployment payments after experiencing problems with ID.me. A Cyberscoop article also showed that ID.me claimed to use facial recognition in order to match faces to documents, but in fact uses one-to-many matching, meaning it compares people's faces to a stored database of photos. ID.me hasn't disclosed how many images it has stored, nor how it got them.

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," IRS Commissioner Chuck Rettig said in a statement. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."

Got a tip? Contact this reporter at chaskins@insider.com or caroline.haskins@protonmail.com, or via secure messaging app Signal at +1 (785) 813-1084. Reach out using a non-work device.