The United States’ Internal Revenue Service will no longer use third-party facial recognition technology on millions of Americans who use the agency’s website to pay taxes or access documents.
The IRS said on Monday it would transition away from using the identity verification company ID.me in the coming weeks and develop a new authentication system that does not use facial recognition. The announcement comes hours after US lawmakers asked the IRS to “halt its plans” to use the technology.
“The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised,” said the IRS commissioner, Chuck Rettig. “Everyone should feel comfortable with how their personal information is secured and we are quickly pursuing short-term options that do not involve facial recognition.”
Citing privacy and security concerns, Democratic lawmakers on Monday had said they were “deeply concerned” about the IRS’s deal with ID.me, the face-recognition company that promises to verify taxpayers’ identities with a selfie.
“Millions of Americans use the IRS website annually for a variety of vital functions, and, as a result, each of them will be forced to trust a private contractor with some of their most sensitive data,” the lawmakers, Ted Lieu, Anna Eshoo, Pramila Jayapal and Yvette Clarke, said in a letter. “We urge the IRS to halt this plan and consult with a wide variety of stakeholders before deciding on an alternative.”
The lawmakers demanded that the agency pause its plans until it addresses concerns raised by Congress and consults with stakeholders in the civil rights and civil liberties communities.
Digital rights groups warned using facial recognition systems for identity verification when filing taxes raises myriad privacy and discrimination issues. Studies have shown both technologies ID.me uses in its identity fraud and verification processes – face-matching and facial recognition systems – often misidentify Black and brown faces. The use of such technologies also creates a massive database of information that can be vulnerable to cybersecurity attacks or shared with other government entities.
Among the personal data the company is collecting are users’ images, “inferred citizenship” based on passport information, voiceprints, location data, addresses, social security numbers, driver’s license numbers, passport-card numbers and more. ID.me said it only shares this user information with government entities in response to a subpoena or other legal request or in the case of an identity theft investigation.
“If they switch to another company, a lot of the issues will be the same,” said Caitlin George, Fight for the Future campaign director. “The number of problems just outweigh the benefits. And that’s why we don’t think it should be used at all.”
Lieu said that the IRS had failed to justify why it needs to give a third-party contractor access to the biometric data of millions of Americans. “I could do banking transactions right now, without having to have facial recognition. Why does the IRS need to have facial recognition to allow Americans to simply use their portal?”
