The IRS will soon make you use facial recognition to access your taxes online

Income tax time is upon us again and things are changing. The Internal Revenue Service will require people who access and pay their taxes online to enroll in a third-party facial recognition company starting this summer. Even those who have already registered on IRS.gov with a username and password will have to provide a government ID, a copy of a utility bill, and a selfie to ID.me, the Virginia-based identity verification company. You’ll take a video selfie with whatever webcam or mobile device you’re using to sign up, which seems likely to cause problems for people with older hardware or who don’t have access to a device with a webcam.

According to the IRS, ID.me is a “trusted technology provider” of identity verification services. Anyone who already has an ID.me account from another government agency can sign in with those credentials. Brian Krebs (KrebsOnSecurity.com) created a new ID.me account and wrote in his post that the sign-up process was time-consuming and glitchy. He got stuck about halfway through the process and had to start again from the beginning, then was prompted to join a video call with an ID.me representative — with a wait time of nearly three and a half hours.

Most US government agencies are using facial recognition
In its “privacy bill of rights,” ID.me says it doesn’t “sell, lease, or trade biometric data to any third parties or derive any profit from the sale, lease or trade of biometric data.” It can share information with its partners with users’ explicit permission, according to its website, and when you register for an ID.me account, you’ll have to accept the company’s biometric consent policy. The company collects facial and voice biometrics to verify identity and protect against fraudulent behavior and to “comply with a request from law enforcement or government entities where not prohibited by law.” And even if you delete your ID.me account, the company may retain your biometric data for several years, depending on “the nature of the data and relevant legal or operational retention needs.”

You may remember ID.me from earlier in the pandemic when more than two dozen states used the company to verify people applying for unemployment benefits.

Although we should get through our 2021 taxes without having to create an ID.me account, the handwriting is on the wall… setting our expectations for the 2022 tax season come 2023.

Update (2-1-2022)
The Treasury Department and Internal Revenue Service (IRS) are reportedly looking for alternatives to the controversial facial recognition software ID.me, according to a report by Bloomberg. As Bloomberg notes, the agencies didn’t cite a reason for the possible change, and also didn’t mention any privacy concerns about the service.

BUT – The privacy concerns are:
Although ID.me previously claimed it only uses one-to-one facial matching, which involves matching a user’s face with images of the same face, ID.me CEO Blake Hall admitted it uses technology that matches faces against a larger database. This only exacerbates privacy concerns — politicians, the American Civil Liberties Union, and digital rights advocates have already spoken out about the IRS’ use of the software.