The IRS and Facial Recognition

The IRS, which was dealing with a lot of controversy over its decision to use facial recognition software, has reversed course, and in February 2022, announced it would allow taxpayers to use alternative methodologies to authenticate their accounts. The IRS had adopted the technology as a way to enhance security of taxpayer information and avoid data leaks.

Initially, the IRS had said it was instituting a program that would ask taxpayers who want to log in to its website to use facial recognition software to verify their identity. This was not going to be mandatory for taxpayers who already had a username and password.

They then announced that they were ending the program even before it became mandatory. The IRS also said they were shifting to an entirely different identity verification system in 2023 as part of their attempt to alleviate the backlash over its decision to use biometric data.

Activist groups and lawmakers argued that the requirement, which allows a private company (ID.me) to collect personal photos and data under an $86 million contract, was an invasion of privacy and had no guardrails for how the photos and data will be used in the future. They wanted stricter limits on facial recognition to protect privacy. ID.me, which has been around for about 10 years, became a “go to” for more than half the states seeking to prevent fraudulent claims in regard to unemployment and child-care credit claims during the pandemic. California, Florida, New York and Texas are among the states that are already using the software. In addition, ID.me also verifies identities for a number of federal agencies, including the Department of Veterans Affairs, Social Security Administration and U.S. Patent and Trademark Office.

ID.me’s verification process includes taking a picture of a photo ID (e.g., a driver’s license or passport) and then taking a video selfie with a smartphone or computer so software can compare the two. Then, there is an in-person video call with an agent. According to a company spokesperson, ID.me first uses one-to-one facial recognition for verifying the identities of users and then checks users against an internal database of selfies to look for “prolific attackers and members of organized crime who are stealing multiple identities.” People who are matched with a photo in ID.me’s database are sent to a video chat for verification.

The process can be complicated, and users have reported many glitches, including difficulty uploading the required documents and long waits for the video call. These problems have resulted in people having to wait to get their benefits.

Per the IRS statement, they would “transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts.” It further said it would “quickly develop and bring online an additional authentication process that does not involve facial recognition.” It appears that facial recognition is off the table for the short term, but we will be watching carefully for future developments.